Programming tool
Password Generator
Create random passwords or memorable passphrases with the character sets and length you need. Everything is generated locally using your browser's cryptographic random number generator.
Generated password
Generated locally with your browser's cryptographic random number generator. Nothing is sent to a server.
Why random passwords matter
Attackers rarely guess passwords one at a time. They run automated tools that try billions of combinations built from leaked password lists, dictionary words, names, dates, and common substitutions such as replacing an a with an @. A password that a person invents almost always follows one of those patterns, which makes it far easier to crack than its length suggests.
A truly random password has no pattern to exploit. Every character is chosen independently from the full set, so the only strategy left is brute force, and brute force becomes impractical very quickly as length increases. This generator uses the Web Crypto API with rejection sampling, so every character is equally likely and the result cannot be predicted from earlier output.
How entropy works
Entropy measures how many equally likely possibilities an attacker has to search, expressed in bits. Each extra bit doubles the number of possibilities. For a random password, the entropy depends on two things: how many characters it contains and how large the pool of possible characters is.
A 16-character password drawn from uppercase, lowercase, digits, and symbols has a pool of 90 characters, giving roughly 16 × 6.49 = 104 bits. A 12-character password using only lowercase letters has 12 × 4.70 = 56 bits. Adding length raises entropy faster than adding character types, which is why a long password made of simple characters can beat a short, complicated one.
For passphrases the same formula applies with words instead of characters: entropy equals the number of words multiplied by log₂ of the word list size. With this tool's 343-word list, each word adds about 8.4 bits.
Reading the strength meter
The meter groups entropy into four bands. Under 40 bits is weak and can fall to offline cracking in minutes. 40 to 60 bits is fair, adequate for low-value accounts protected by rate limits. 60 to 80 bits is strong and resists dedicated offline attacks. 80 bits or more is very strong and is beyond practical brute force with current hardware. These bands assume the password is genuinely random; a human-chosen password with the same length would score far lower.
Tips for using generated passwords
- Use a password manager. Random passwords are only practical if you never have to remember or retype them, and a manager will store, fill, and sync them securely across devices.
- Use a unique password for every site. When one service leaks its database, attackers immediately try those credentials everywhere else. A unique password limits the damage to a single account.
- Turn on two-factor authentication where it is offered. Even a very strong password can be phished, and a second factor protects you when that happens.
- Choose a passphrase for anything you must type by hand, such as the master password for your manager, a disk encryption key, or a Wi-Fi password that guests will enter.
Frequently asked questions
Are the passwords sent anywhere?
No. Passwords are generated entirely in your browser using crypto.getRandomValues and never leave your device. There is no server request, no logging, and nothing is stored after you leave the page.
How long should a password be?
For a random password using all four character sets, 16 characters gives over 100 bits of entropy and is a sensible default for most accounts. Use 20 or more for anything protecting financial data, email, or a password manager vault. If a site only allows letters and digits, compensate by making it longer.
Is a passphrase as strong as a random password?
It can be, provided the words are chosen at random rather than by you. Four random words from this list give about 34 bits, six give about 51 bits, and eight give about 67 bits. That is lower per character than a random string, but a passphrase is far easier to remember and type accurately, so you can make it longer. Appending a random number adds about 10 bits more.
What does excluding ambiguous characters do?
It removes characters that look alike in many fonts, such as the lowercase l, uppercase I, the digit 1, uppercase O, the digit 0, lowercase o, and the vertical bar. This makes a password easier to read aloud or copy from paper at a small cost in entropy, since the pool shrinks by seven characters.
Why does every generated password contain each character type?
Many sites require at least one uppercase letter, digit, or symbol. The generator reserves one slot for each enabled set and then fills the remaining positions randomly before shuffling, so the password always passes those checks without any predictable structure.
Is it safe to use an online password generator?
It is safe when generation happens on your device, as it does here, rather than on a server that could log the output. You can confirm this by loading the page, disconnecting from the internet, and generating a password; it still works because no network request is involved.