About this tool
This generator uses your browser's cryptographically secure random number generator (crypto.getRandomValues) to pick every character. The page does not send the password anywhere: there is no network request, no analytics script and nothing is saved.
Characters are chosen uniformly from the sets you enable, with at least one character from each set. "Exclude look-alike characters" removes characters that are easy to confuse when reading or typing a password: 0 O o 1 l I | and a few similar symbols.
How to read the results
The strength meter shows the password's entropy in bits: how many guesses an attacker would need, as a power of two, if they knew exactly how it was generated. Because each character is chosen at random, this number is accurate for passwords made here. It does not apply to passwords you invent yourself, which are usually far weaker than their length suggests.
- Below 50 bits — weak; only acceptable where the service strictly limits login attempts.
- 50–74 bits — fair; fine for most online accounts protected by rate limiting.
- 75–99 bits — strong; suitable for important accounts.
- 100 bits or more — very strong; suitable for password-manager master passwords, encryption keys and Wi-Fi keys.
A 16-character password using all four character sets has about 103 bits of entropy.
Limitations
- Password strength only protects you if the password is unique to one account. Use a password manager to store a different password for every site.
- Some sites limit length or reject certain symbols. If a password is rejected, turn off symbols or reduce the length rather than editing the password by hand.
- The generator needs JavaScript, because generating in your browser is what keeps the password off the network.
- Copying to the clipboard makes the password available to other apps on your device until the clipboard is overwritten.
Frequently asked questions
Are the passwords sent to your server?
No. They are generated by JavaScript running in your browser. You can confirm this in your browser's developer tools: generating a password causes no network request.
How long should a password be?
For accounts stored in a password manager, 16–20 random characters is a good default. For a password you must type or remember, consider a longer passphrase of random words.
Is it safe to use symbols?
Yes, symbols add entropy. A few older systems reject some symbols; if that happens, remove symbols and add a few characters of length instead — a longer password without symbols can be just as strong.
Why exclude look-alike characters?
When you have to read a password aloud or type it from a screen or printout, characters like 0/O and 1/l/I cause mistakes. Excluding them reduces entropy slightly per character; add a character or two of length to compensate.
What does "entropy" mean?
Entropy measures unpredictability. Each extra bit doubles the number of guesses needed. A password with 80 bits of entropy would take 2^80 (about 10^24) guesses to exhaust.
Is this password generator free?
Yes, free and without sign-up.
Can you see the passwords I generate?
No. They are created in your browser and never sent to us.
What length should I pick?
16 characters or more; NIST recommends at least 15 when a password is the only factor.
Should I change passwords regularly?
Only when there is a sign of compromise. Forced periodic changes lead to weaker passwords.