About this generator
The password is built by calling /api/ints for one uniformly random integer per character, then mapping each integer into your chosen alphabet (lowercase, uppercase, digits, and symbols). The underlying integers come from the same HMAC-SHA256 byte stream that powers the rest of the Provable.io API, so each password generation gets a permanent verifiable permalink.
The rendered password string itself is never stored — only the random integers and seed metadata that produced it.
For developers
Need raw random bytes instead? Hit the bytes endpoint directly:
curl "https://api.provable.io/api/bytes?clientSeed=YOUR-SEED&count=32&encoding=hex"
See the full reference at /api-docs.
Frequently asked questions
Is this password safe to use?
The bytes are generated server-side by a provably fair HMAC-SHA256 stream and delivered to your browser over HTTPS. Use a unique password per site and store it in a password manager.
Is the password stored anywhere?
The plaintext password is never persisted by Provable.io. The underlying RNG call records only the random integers and the seed metadata, not the rendered password string, so the password cannot be recovered from our logs.
How long should my password be?
16 characters of mixed letters, digits, and symbols is a strong baseline for most sites. Bump to 24+ for accounts that don't enforce 2FA.
Why is this "provably fair"?
Each password call gets a server-hash-anchored permalink. If you ever need to prove the password was machine-generated and not chosen on purpose (e.g. for audit or shared-credential trust reasons), the permalink and verifier are the receipt.