Password Generator
Generate strong, random passwords instantly. Customise length and character types. Everything happens in your browser — nothing is ever sent anywhere.
🎲 Cryptographically Random
Uses crypto.getRandomValues() — the same randomness source used by security software. Not Math.random().
🔒 100% Private
Your passwords are generated entirely in your browser. Nothing is sent to any server. Nothing is logged or stored.
📏 How Long Should It Be?
20 characters with mixed types is excellent. 16+ is required for any account that matters. Never go below 12.
Store Your Passwords Safely
A strong password only helps if you can remember it — or store it securely. Password managers generate and store unique passwords for every site.
Frequently Asked Questions
How long should my password be?
20+ characters with mixed types gives you 100+ bits of entropy — strong enough to resist any known attack. 16 characters is the minimum for any sensitive account. Never use fewer than 12 characters.
Is it safe to use this password generator?
Yes. All generation happens in your browser using crypto.getRandomValues(). Your password is never sent to any server, never logged, and never stored. This is safer than most desktop generators.
Should I use a password manager?
Absolutely. A strong unique password per site is only practical with a password manager. We recommend 1Password, Bitwarden (open source), or Dashlane. They generate and remember passwords so you never have to.
What are "ambiguous characters" and should I exclude them?
Characters like 0, O, l, 1, and I can look identical in some fonts. Excluding them prevents transcription errors if you ever need to type the password manually. For passwords stored in a manager, this does not matter.
How to use the Password Generator
- Set the length first. The slider goes from 8 to 64 characters and defaults to 20, which is a sensible minimum for anything important. If a site imposes a maximum length, set it to that limit — a longer password that complies with the site's rules is always better than a shorter one.
- Choose the character types. Uppercase, lowercase, numbers, and symbols are all enabled by default. Turn types off only when a site's rules demand it; every enabled type enlarges the character set and therefore the entropy.
- Decide on the ambiguous characters option. Leave it off when the password will live in a password manager and you will never retype it. Turn it on when you might need to type the password on a phone or into a remote console, where
0/Oand1/l/Iare easy to mix up. - Click Generate and watch the meter. The strength bar and the entropy figure update instantly with every click. Keep regenerating until the output looks comfortable to you — all candidates are equally strong, since strength comes from the random process, not from the specific string.
- Copy straight into your password manager. Use the Copy button and paste the password into the vault entry, or into the site's sign-up form. Do not email, message, or otherwise transmit the password in plain text.
- Never reuse it. Generate a fresh password for every site. If one service is breached, every other account stays safe.
Why length beats complexity
The strength of a randomly generated password is measured in entropy, calculated as length × log2(charset size). The maths has a clear lesson: length compounds the effect of every character type you enable. With lowercase alone the set has 26 characters (about 4.7 bits each); adding uppercase makes 52 (5.7 bits); numbers make 62 (5.95 bits); and symbols bring the total to 94 (about 6.55 bits). Notice that switching to all four types adds less than two bits per character, while adding a single character to your length adds the full set size every time.
Concretely: a 12-character password using only lowercase letters has about 56 bits of entropy, which a determined offline attack can now break. Bump it to 20 characters with all four types and you get roughly 131 bits — the number of possibilities grows so fast that exhaustively searching it is physically impractical. Security sites push “complexity rules” such as mandatory symbols, but those rules exist mainly because their systems predate modern advice. A 20-character string of random lowercase letters is harder to crack than a 12-character string with every symbol in the book.
There is one caveat worth remembering: this math assumes the password is genuinely random, which is exactly what this tool produces using crypto.getRandomValues(). Human-picked passwords built from names, dates, or dictionary words contain far less entropy than their length suggests, because attackers guess those patterns first. That is why the strength meter trusts the generator's output — and why you should never let a human, including yourself, hand-craft the passwords this tool is designed to replace.