Password Generator
Generate a strong random password of any length from your browser’s cryptographic random source. Nothing is generated on a server and nothing is stored — the password exists only on this page and on your clipboard.
Password Strength
Very StrongCharacter Types
Frequently asked questions
How long should a password be?
Sixteen characters is a sensible floor for an account that matters, and 20 or more for a password manager master password or anything protecting money or infrastructure. Length buys far more strength than exotic characters do: each extra character multiplies the number of guesses an attacker has to make, which is why the entropy figure under the strength bar climbs faster when you drag the slider than when you switch on symbols.
Are these passwords really random?
Yes. Each character is drawn from your browser’s cryptographic random number source, crypto.getRandomValues, using rejection sampling so that every character in the set is equally likely. One character from each enabled type is drawn first, so a password never comes out missing the digits or symbols you asked for, and the whole thing is then shuffled with the same source. Math.random, which many generators use, is not designed to be unpredictable and is not used here.
Is it safe to use an online password generator?
It depends entirely on where the password is generated. This one generates it on your device: the page makes no network request when you press Regenerate, so the password exists only in your browser and on your clipboard. A generator that builds the password on a server has by definition seen it, and you have no way to check what it did with it.
What does the entropy figure mean?
It is the number of bits of randomness in the password, worked out from its length and the size of the character set it was drawn from, and it is what the strength label is based on: below 40 bits is Very Weak, Weak up to 60, Strong up to 80 and Very Strong from 80 bits. Every extra bit doubles the number of guesses needed to brute-force it, so a password under 40 bits falls to an offline attack in minutes on modern hardware, while 80 bits and up is comfortable for anything short of a nation-state adversary.
Why are lowercase letters always on?
Because a password needs at least one character set to be drawn from, and lowercase is the one every system accepts. Leaving it switchable would let you build an empty character set and an impossible password, so it is fixed and marked Always On instead.
Should I turn on symbols?
Turn them on where the system accepts them — they widen the character set from 62 to 94, which is worth roughly ten extra bits on a 16-character password. Some older systems silently truncate or reject punctuation, so if a login mysteriously fails, switch symbols off and add two characters of length instead; you end up at about the same strength. If a password has to be read aloud or typed from paper, tick Exclude ambiguous characters to leave out 0, O, 1, l, I and |; that costs about two bits at 16 characters, which one extra character more than pays back.
Are the generated passwords stored or sent anywhere?
No. The whole tool is JavaScript running in your own browser, so nothing you type or paste is sent over the network, written to a log or attached to an analytics event. You can confirm it by opening the network tab and watching it stay empty while you work.