# 120 random passwords for servers, master keys, admin accounts > Online secure password generator free: 120 strong passwords from 10 to 32 characters, ASCII or alphanumeric. Generated via OS CSPRNG. Click to copy. Free in-browser tool (no upload): https://www.mauriziofonte.it/tools/password-generator 120 random passwords generated with the **Unbiased Random Selection** method (OS CSPRNG with rejection sampling). Lengths from 32 down to 10 characters. Click any password to copy it to clipboard. ## Why these passwords are genuinely secure Generation uses **unbiased random sampling** via PHP's `random_bytes()`, which calls into the OS CSPRNG (`/dev/urandom` on Linux, equivalents on other OSes), with rejection sampling (bit mask, out-of-range values discarded) that avoids the modulo bias many artisan generators get wrong: every character has probability exactly 1/|charset|. On 20 ASCII characters the real entropy is 128 bits. For comparison, a "strong" password picked by a human typically has 30-50 bits of entropy and is brute-forceable in hours on modern GPUs. The passwords served on the page exist only in the HTML sent to your browser: they are not logged, not persisted anywhere, and do not survive page reload. ## Frequently asked questions ### How long is a truly secure password in 2026? Personal accounts: at least 16 ASCII characters (roughly 100 bits of entropy). SSH servers, API keys, admin accounts: 24-32 characters. The real security factor is total entropy, not character class: a 30-char ASCII password is more secure than a 12-char password with 'mandatory symbols'. ### Why don't the passwords contain '0', '1', 'l', 'I', 'O'? Visual ambiguity. If you have to read or type the password by hand (on mobile, on a serial console, on a remote terminal), lookalike characters cause errors. Excluding 8 chars out of 94 (0, 1 and the letters I/L/O both upper and lower case) only changes per-char entropy by ~0.13 bits, negligible compared to total length. ### Are generated passwords logged or sent anywhere? No. The PHP that generates passwords runs server-side in an isolated process, doesn't log output, doesn't store anywhere. Every page reload produces 120 fresh passwords that only exist in the HTML served to you. HTTPS always. ### Is random_bytes() really secure? Yes. In PHP 8.x `random_bytes()` reads from the OS CSPRNG (`/dev/urandom` on Linux, equivalents on other OSes): the same entropy source that backs standard cryptographic tooling, and when no entropy is available it throws an exception instead of returning weak bytes. The generator applies rejection sampling to avoid modulo bias, a critical detail many artisan generators get wrong and which leads to non-uniform character distributions across the charset. ### Can I use these passwords for encryption or API keys? For account and service passwords they are fit for purpose. For cryptographic keys (AES, RSA, ECDSA) no: keys must be generated directly with the crypto library that will use them, in the format and length specific to the algorithm. Using an ASCII password as a crypto key introduces an unnecessary KDF derivation, typically done wrong. ### What if I work at a company where passwords are shared in an Excel file? Very common, very risky, very fixable. Migrating to an enterprise password manager (self-hosted Bitwarden, 1Password Business, Vaultwarden) takes 2-3 days of setup + training. If you want a structured path for your SMB, [get in touch](/pages/contattami): this is one of the areas I work on regularly. --- Tool by Maurizio Fonte, senior backend engineer. All tools: https://www.mauriziofonte.it/tools/