About the Password Generator
This free password generator creates strong, random passwords. Choose the length and which character types to include, and get a unique password instantly — with a strength meter that reports real entropy in bits, not a vague colour.
Passwords are generated in your browser using crypto.getRandomValues, the browser's cryptographically secure random source. Nothing is sent anywhere, nothing is logged, and no password you see here has ever existed on a server. That is not a small detail: a password generator that generates on a server is a password generator you have to trust completely.
What actually makes a password strong
Not symbols. Not a capital letter at the front and a 1 at the end. Length and randomness — those are the only two things that matter, and of the two, length matters more.
The measure is entropy, counted in bits. Each bit doubles the number of possibilities an attacker has to work through. A password drawn randomly from a set of 62 characters (letters and digits) carries about 5.95 bits per character, so a 12-character one is about 71 bits and a 16-character one about 95.
What those numbers mean in practice, against an attacker with serious hardware guessing offline:
- Under 40 bits — falls in seconds
- 50–60 bits — hours to days
- 70–80 bits — years, and impractical for most attackers
- 90+ bits — not happening with current technology
Adding four characters to a password does far more than adding a ! to it. Every character you add multiplies the work; a symbol only widens the alphabet slightly.
Why "Passw0rd!" is weak and a long random one is not
Password rules taught a generation of people to make passwords that are hard for *humans* to remember and easy for *computers* to guess. Capital at the front, a digit at the end, an @ for an a. Attackers know all of it. Every cracking tool applies those exact substitutions automatically, because everybody makes the same ones.
A real attack does not step through aaaa, aaab, aaac. It starts with leaked password lists — billions of real passwords from real breaches — then applies the predictable mutations. P@ssw0rd! is in those lists many times over. It has 9 characters and roughly zero effective entropy.
A random 16-character password has no pattern to exploit, so none of that machinery helps. It has to be brute-forced, and brute force at 95 bits does not finish.
The other half of this is reuse. When a site is breached, the stolen email and password pair gets tried automatically against hundreds of other sites. One reused password turns one company's mistake into your problem everywhere. A unique random password per site contains the damage to that one account — which is the real argument for a password manager.
Choosing a length
- 16 characters — a good default for almost everything
- 20+ characters — email, banking, your password manager's own master password, anything that can reset other accounts
- 12 characters — acceptable minimum when a site refuses anything longer
- Under 12 — only when a system forces it, and treat the account as weakly protected
Your email account deserves the longest one you use. Whoever controls your email can reset the password on nearly everything else.
About the look-alike option
Turning on Exclude look-alikes removes O, 0, l, 1, I and friends — the characters people confuse when reading a password off a screen and typing it somewhere else.
Use it when a password has to be typed by hand: a Wi-Fi key on a router card, a device set up with a remote control, something dictated over the phone, something printed and handed over.
Leave it off when the password goes straight into a password manager and will only ever be pasted. Excluding characters shrinks the alphabet, which costs a little entropy — easily paid back by adding a character or two to the length.
How to use it
- Set the length and choose character types (uppercase, lowercase, numbers, symbols)
- Generate — a new password appears (click again for another)
- Copy — use the copy button and paste it where you need it
Good to know
- Never reuse a generated password. Its strength does nothing if the same string is protecting five accounts.
- Store it in a password manager, not a note, a spreadsheet or a browser tab. A strong password you cannot remember is only useful if something remembers it for you.
- Some sites silently truncate. A few systems cut passwords at 16 or 20 characters without saying so. If a long password is rejected at login but accepted at sign-up, that is usually why.
- A few sites still ban symbols. Turn symbols off and add length instead — you lose almost nothing.
- Turn off autocomplete worries: copying a password to the clipboard leaves it there. Copy something else afterwards if you share the machine.
- Two-factor authentication beats a longer password. Once you are past about 16 random characters, your next security improvement is 2FA, not character 17.
Common questions
How long should a password be?
Sixteen random characters is a sensible default and is strong enough for almost any account. Use twenty or more for your email, your bank and your password manager's master password, since those can unlock everything else. Twelve is a reasonable floor when a site will not take more. Length buys far more safety than adding exotic symbols to a short password.
Are these passwords really random?
Yes. They come from crypto.getRandomValues, the browser's cryptographically secure random number generator — the same class of source used for encryption keys. It is not Math.random(), which is predictable and unsuitable for anything security related. The generation happens entirely on your device.
Is it safe to generate a password on a website?
It depends entirely on where the generation happens. If a site generates on its server, that server has seen your password and you are trusting it completely. This one generates in your browser: the password is created on your device, never transmitted, and never exists anywhere else. You can confirm it by disconnecting from the internet — the tool keeps working.
Do I need symbols in my password?
They help a little, but far less than people assume. Adding symbols widens the alphabet from 62 characters to about 94, worth roughly 0.6 extra bits per character. Adding two more characters is worth more than that. If a site rejects symbols, just make the password longer and you have lost nothing meaningful.
What does the bits number mean?
It is entropy — how much genuine randomness the password contains. Each extra bit doubles the number of guesses an attacker needs. Under 40 bits is broken quickly; 70 to 80 bits is impractical to crack; above 90 bits is beyond current technology. It is a far more honest measure than a red-amber-green bar, which usually just counts character types.
Should I change my passwords regularly?
Not on a schedule. Forced rotation makes people pick weaker, more predictable passwords — Summer2024! becomes Summer2025!. Current guidance from NIST is to use long unique passwords and change them when there is a reason: a breach notice, a shared password, or any suspicion the account was accessed.
What if a site limits my password length?
Generate at the longest length it accepts and turn off symbols if it rejects those. Watch for silent truncation — if a password works when you set it but fails at the next login, the site probably cut it short without telling you. Set a shorter one deliberately so you know exactly what it stored.
Related tools
- Hash Generator — MD5, SHA-1 and SHA-256, to see how passwords get stored
- UUID Generator — random identifiers, for when you need a unique value rather than a secret
- Random Number Generator — the same secure random source, for numbers
- What Is My IP — see how much your browser reveals without being asked
