Password Generator
Choose a length and character types to create a strong password instantly. It uses true cryptographic randomness and is never sent to a server.
Please select at least one character type.
How to use
How this password generator works
This password generator builds a random password from the character types you choose, entirely inside your browser. Move the slider to set a length from 4 to 64 characters, tick the character types you want, and a new password appears instantly. The strength meter shows an estimate in bits of entropy, which is the honest way to describe how hard a random password is to guess. Press Generate again as often as you like; every click makes a brand-new password and nothing is saved or uploaded.
Where the randomness comes from
Many simple generators call Math.random(), which is fine for games but not designed for secrets. This tool uses the browser’s crypto.getRandomValues(), the same cryptographically secure source websites use for security tokens. It also avoids a subtle bias called modulo bias: when a random number is squeezed into a smaller range with a plain remainder, some characters become slightly more likely than others. The generator discards the few values that would cause that and draws again, so every character in the pool has exactly the same chance. Finally, if you select several character types, it guarantees at least one character from each type and then shuffles the result, so the password never ends up with its symbols all bunched at the end.
How strength is measured
Entropy is the number of bits needed to describe how many equally likely passwords could have been produced. For a random password the formula is simple:
entropy (bits) = length × log2(size of the character pool)
With all four types selected, the pool holds 86 characters: 26 lowercase letters, 26 uppercase letters, 10 digits and 24 symbols. A 16-character password therefore has about 16 × 6.43 = 103 bits. A 12-character lowercase-only password has only 12 × 4.70 = 56 bits, which leaves about 140 trillion times fewer possibilities for an attacker to search. The meter labels anything under 40 bits Weak, 40 to 70 bits Fair and 70 bits or more Strong. These bands are guidelines. For accounts that matter, such as email, banking and your password manager, aim well above 70 bits, which in practice means 14 or more characters from a mixed pool.
Each extra character multiplies the number of possibilities by the pool size, so adding length helps far more than adding exotic symbols. Going from 12 to 16 characters in an 86-character pool multiplies the search space by about 55 million.
What security guidance says about passwords
The U.S. National Institute of Standards and Technology (NIST) publishes the digital identity guidelines that many organizations follow, in Special Publication 800-63B. Its direction is consistent: favor length over complicated composition rules, allow long passwords and passphrases, do not force people to change passwords on a schedule without a reason, and check new passwords against lists of known breached or commonly used passwords. A random password from this tool already satisfies the “not guessable” part. What it cannot do is protect you from phishing, from reusing the same password on two sites, or from a service that stores passwords carelessly. Those risks are why the next three habits matter more than any single password.
- Use a different password for every account. When one site is breached, attackers try the leaked email and password on other services. This is called credential stuffing, and it is how many accounts are taken over.
- Store them in a password manager. A random 20-character password is impossible to memorize, and it should be. Let a reputable manager fill it in and keep only one strong master passphrase in your head.
- Turn on two-step verification or passkeys. An authenticator app, hardware key or passkey protects the account even if the password leaks.
Why “exclude look-alike characters” exists
The uppercase letter I, the lowercase l and the digit 1 look nearly identical in many fonts, as do O, o and 0. If you will ever read a password aloud, type it from a printed sheet or enter it on a TV or game console, turn this option on. The pool shrinks from 86 to 80 characters, which costs only about 0.1 bit per character, a price worth paying to avoid a typo.
Passwords for sites with odd rules
Some sites still reject certain symbols, cap length at 16 or 20 characters, or demand at least one of each type. If a site refuses a symbol, untick Symbols and add a few extra characters of length to make up the lost entropy. If it requires one of each type, leave all four ticked; the generator already guarantees one character from each selected type as long as the length is at least the number of types.
A quick way to build a memorable master password
Your password manager still needs one password you can type from memory. Use a passphrase: pick four or five unrelated words at random (dice and a word list work well, or any random word picker), join them with a separator, and add a number if the site demands one. Something like “copper-lantern-orbit-pickle-42” has far more entropy than a clever eight-character mix and is easier to type on a phone. Do not use song lyrics, quotes or anything tied to your biography, because attackers test those first.
Frequently asked questions
Is this password generator safe to use?
Yes. The password is created locally with your browser’s cryptographic random number generator, and it is not stored, logged or transmitted. You can even disconnect from the internet after the page loads and it will keep working. As with any secret, avoid generating passwords on a shared or untrusted computer.
How long should my password be?
For most accounts, 16 characters with a mix of types is a strong default. Use 20 or more for email, banking and your password manager, since those protect everything else. Very short passwords under 10 characters can fall quickly to offline guessing if a site’s database leaks.
Are passphrases better than random characters?
Both are good if they are truly random. A passphrase of four or five randomly chosen common words is easier to remember and type, which makes it ideal for a master password or a device login. For everything else, let a password manager store a long random string like the ones made here.
Do symbols make a password much stronger?
Less than people think. Symbols widen the pool a little, but each extra character of length helps more. A 20-character password with letters and digits only is stronger than a 12-character one with every symbol. Include symbols when a site demands them, and rely on length for strength.
What does the entropy number mean?
It estimates how many guesses an attacker would need in the worst case. Every added bit doubles that number, so 80 bits is not slightly stronger than 70, it is about a thousand times stronger. The figure assumes a truly random password. A password you choose yourself, such as “Summer2024!”, is far weaker than its length suggests.
Should I change my passwords regularly?
Not on a fixed schedule. Current guidance from NIST advises changing a password when there is evidence it was exposed, not every 90 days, because forced rotation tends to produce weaker, predictable passwords. Change a password immediately after a breach notice or if you reused it anywhere.