Password Generator
Create strong random passwords with the character types you need. Generated on your device using the browser's cryptographic random source — never sent, logged or stored.
Length matters more than any other setting. Anything under 12 is short by today's standards; the maximum here is 128.
Far beyond brute force. Length past this point adds little.
Select at least one character type.
A password manager is still the right place to keep these — reusing even a strong password across sites is the risk worth avoiding.
What the Password Generator does
- Generates random passwords using your browser's cryptographic random source, the same primitive used for encryption keys.
- Lets you control length and which character types are included, and exclude look-alike characters such as O, 0, I and l.
- Reports genuine entropy in bits, calculated from the alphabet size and length, rather than an invented strength score.
- Guarantees at least one character from each type you select, so generated passwords pass the usual site rules.
What it doesn't do
- It doesn't store, transmit or remember anything. Refreshing the page discards everything permanently.
- It doesn't check whether a password has appeared in a breach.
- It isn't a password manager — it makes passwords, it doesn't keep them.
Frequently asked questions
Is it safe to generate a password on a website?
For this tool, yes: generation happens entirely in your browser using the Web Crypto API, with nothing sent over the network. You can verify that by disconnecting from the internet after the page loads and generating again. That said, the most cautious option is always the generator built into your password manager or operating system.
How long should a password be?
Length beats complexity. Sixteen characters from a mixed alphabet is comfortably beyond practical brute force; twenty is a good default. Adding length increases difficulty far more than swapping an "a" for an "@".
What does entropy in bits actually mean?
It's the base-2 logarithm of the number of possible passwords your settings can produce. Each extra bit doubles the guessing effort. Below about 50 bits is weak, 75 and above is strong, and past 100 bits the number is astronomically large.
Should I exclude look-alike characters?
Only if you'll type the password by hand or read it aloud. Removing them slightly shrinks the alphabet, so add a character or two of length to compensate. If the password goes straight into a password manager, leave them in.