Password Generator
Generate strong random passwords with your choice of length and character sets, using cryptographically secure randomness.
How to use this tool
Steps for using the Password Generator.
- Set the length with the slider or the number box (4–128, default 20).
- Choose the character sets — lowercase, uppercase, digits and symbols — and edit the symbol set if a site rejects some characters.
- Tick Exclude ambiguous to drop
I,l,1,O,0andowhen the password will be read or typed by a person. - Choose how many passwords to generate (1–50) and click Generate; new passwords also appear whenever you change an option.
- Check the entropy estimate and strength label, then copy one password or all of them into your password manager.
Example
Default settings
Length 20 · lowercase, uppercase, digits, symbols (87 possible characters)Very strong · about 128 bits of entropy (87 possible characters × 20)Common use cases
- Creating a unique password for a new account to store in a password manager.
- Generating database, Wi-Fi or service-account passwords during setup.
- Creating API secrets or HMAC keys when a long random string is needed — e.g. for the JWT Generator.
- Producing batches of random test credentials for development fixtures.
- Matching a system's password policy by restricting symbols or excluding look-alike characters.
How the passwords are generated
Every character is chosen with crypto.getRandomValues, the browser's cryptographically secure random number generator — not Math.random(), which is predictable. To turn a random 32-bit number into a position in the character pool without bias, the generator uses rejection sampling: a plain random % poolSize would make some characters slightly more likely whenever 2^32 is not a multiple of the pool size, so values from the incomplete final block are discarded and redrawn.
To guarantee that each selected set is represented, one character is drawn from each set first, the remaining positions are filled from the combined pool, and the result is shuffled with a Fisher–Yates shuffle that also uses secure, unbiased random indices. Characters are de-duplicated across sets, so a custom symbol set cannot accidentally weight some characters more heavily.
The entropy figure is log2(pool size) × length — the number of bits an attacker would need to guess if they knew exactly how the password was generated. Each additional character adds log2(pool) bits (about 6.4 bits with all 87 default characters), so length matters more than character variety. The at-least-one-of-each rule reduces the true entropy by a fraction of a bit, which is negligible. The estimate applies only to passwords generated here; it says nothing about passwords people invent, which are far more predictable than their length suggests.
Roughly, under 60 bits is weak against an offline attack on a leaked fast hash, around 80 bits resists well-funded offline attacks, and 128 bits matches the strength of a modern symmetric key. Passwords are generated in this tab only: they are not sent anywhere, not written to localStorage and disappear when you leave the page, so save the one you use in a password manager.
Limitations
- Generates random character passwords only; there is no word-based passphrase mode.
- Entropy is an estimate for randomly generated passwords and assumes the generation method is known to the attacker.
- Symbols are limited to what you enter in the symbol set; some systems reject certain symbols or limit length.
- Passwords are not stored — copy the one you need before leaving the page.
Frequently asked questions
Are these passwords stored or sent anywhere?
No. They are generated in your browser with crypto.getRandomValues and kept only in the page's memory. Nothing is uploaded, logged, sent to analytics or saved in browser storage.
How long should my password be?
For a password stored in a password manager, 16–20 random characters with all character sets is plenty (over 100 bits). If you must type or memorise it, a longer password from fewer character sets is easier to handle with similar strength.
Why exclude ambiguous characters?
I, l and 1, or O, 0 and o, look alike in many fonts. Excluding them helps when a password is read aloud, printed or typed from another screen. It slightly reduces the pool, so add a character or two of length to compensate.
Is a password with symbols always stronger?
Each symbol adds a little to the pool, but length has a bigger effect: 20 lowercase letters (≈94 bits) beat 12 characters from all sets (≈77 bits). The entropy figure shows the trade-off for your settings.
What does "at least one from each set" do to security?
It guarantees passwords meet composition rules such as "must contain a digit". It removes the small fraction of passwords that lack a set, lowering entropy by well under one bit for typical lengths.