Create strong, random passwords online — free, fast, private.
What is a password generator?
A password generator creates random strings of characters that are practically impossible to
guess. Unlike passwords invented by humans — which follow predictable patterns such as names,
dates and common words — a generated password is drawn uniformly from a large character set using
your browser's cryptographically secure random number generator, so every character is independent
of all the others.
How to use this tool
- Drag the length slider to choose between 4 and 128 characters.
- Tick the character sets you want: lowercase, uppercase, digits and symbols. Turn on
exclude ambiguous to drop look-alike characters such as l, 1, I, O and 0.
- Click Generate password and check the strength label and entropy shown below the result.
- Click Copy password, or use bulk mode to create up to 20 passwords at once —
each with its own copy button.
Tips for strong passwords
- Length beats complexity: a 20-character lowercase-only password is stronger than an 8-character one full of symbols. Aim for 16 characters or more.
- Never reuse passwords: one leaked database should never compromise your other accounts — generate a unique password per site.
- Watch the entropy: below 40 bits is Weak, 40–59 bits is Fair, 60–79 bits is Strong and 80 bits or more is Excellent.
- Store passwords safely: a reputable password manager keeps generated passwords encrypted so you never have to memorize them.
Character sets and entropy
Concrete numbers behind the meter: each checkbox combination changes the pool size and the entropy reported at the default length of 16.
| Enabled sets | Pool size | Entropy at length 16 |
|---|
| lowercase only | 26 | 75 bits (Strong) |
| + uppercase | 52 | 91 bits (Excellent) |
| + digits | 62 | 95 bits (Excellent) |
| + symbols | 88 | 103 bits (Excellent) |
| + symbols, exclude ambiguous on | 83 | 102 bits (Excellent) |
Common mistakes, with fixes
- Avoiding exclude ambiguous because it seems weaker. It removes exactly five characters (l, 1, I, O, 0) and costs a single bit at length 16, dropping 103 to 102. If you ever read a password aloud or retype it, turn it on and add one character of length to overcompensate.
- Regenerating until a password looks strong. Every output is drawn uniformly from the same pool, so two 16-character passwords with identical settings have identical entropy. Cherry-picking changes nothing; judge by the bits number instead.
- Keeping symbols enabled for sites that reject them. The symbol set has 26 characters and some forms refuse several. Unchecking symbols at length 16 still yields 95 bits — Excellent — so sacrifice symbols, never length.
The meter recalculates live as you move the slider or toggle a set, so compare configurations before clicking Generate password.
Frequently asked questions
How random are the generated passwords?
They are produced by crypto.getRandomValues, the cryptographically secure random number generator built into your browser — the same source of randomness used for encryption keys. The tool also uses rejection sampling so every character in the chosen set has an exactly equal probability: no modulo bias, and never Math.random.
Are my passwords stored or sent anywhere?
No. Generation happens entirely in your browser with JavaScript. Nothing is transmitted, logged or saved — you can even disconnect from the internet after the page loads and the tool keeps working.
What password length is recommended?
Use at least 16 characters for important accounts such as email, banking and your password manager. For low-value logins 12 is acceptable, and 20 or more with all character sets enabled reaches Excellent strength.
What is password entropy?
Entropy measures how hard a password is to brute-force, expressed in bits. Each extra bit doubles the number of guesses an attacker needs. It equals the password length multiplied by the base-2 logarithm of the character set size, so longer passwords and larger character sets both raise entropy.