How to use the password generator
- Drag the slider to set the length. For most accounts 16 characters is a good default, and 20 or more is better for your email, password manager and banking.
- Choose which kinds of character to include. Leave all four ticked unless a site rejects symbols, in which case untick symbols and add length instead.
- Press Generate new for another, or choose 5 or 10 to see several at once. Press Copy, and paste it straight into your password manager or the sign-up form.
The password is created on your device and is not sent or stored. It disappears when you close or refresh the page, so save it before leaving.
How the passwords are made
Each character is picked with crypto.getRandomValues(), the browser's cryptographically secure random number generator, the same source used for encryption keys. It is not Math.random(), which is predictable and unsuitable for passwords.
The tool also avoids a subtle bias. If you pick a number from 0 to 255 and take it modulo 87, some characters appear slightly more often than others. Here, any random number that falls in the uneven leftover range is thrown away and redrawn, so every random pick is uniform across the pool. When several character types are ticked, one character from each type is placed first and the whole password is then shuffled, so a password never lacks a type you asked for. This guarantee makes the very short passwords slightly more likely to contain a digit or symbol than pure chance would, but the effect on strength is negligible.
What makes a password strong
Strength comes from the number of possible passwords an attacker would have to try. It is measured in bits of entropy:
entropy (bits) = length × log₂(number of possible characters)
Each extra bit doubles the guesses. Length is the strongest lever: adding one character to a password using all four types multiplies the work by 87, while adding a symbol type to a short password adds far less.
| Password | Entropy | Time to try every combination at 1 trillion guesses/second |
|---|---|---|
| 8 characters, all types (87) | 51 bits | About 55 minutes |
| 12 characters, lowercase only (26) | 56 bits | About 1.1 days |
| 12 characters, letters and digits (62) | 71 bits | About 102 years |
| 12 characters, all types (87) | 77 bits | About 6,000 years |
| 16 characters, all types (87) | 103 bits | About 340 billion years |
| 20 characters, letters and digits (62) | 119 bits | About 22 quadrillion years |
These are worst-case times for fast offline attacks against a weak hash, and an attacker finds a password on average in half the time. Real sites also limit attempts, which helps, but the bigger risk is reuse: a unique password for every site means one leak cannot unlock your other accounts.
Worked example
With length 16 and all four types ticked, the pool has 26 + 26 + 10 + 25 = 87 characters (this tool's symbol set has 25 symbols). That gives 16 × log₂(87) = 16 × 6.44 ≈ 103 bits, in the "Strong" band (110 bits and up is rated "Very strong"). Drop to length 10 and the same settings give about 64 bits, which the meter rates "Good". Tick "Avoid look-alikes" and the pool shrinks by five characters (I, l, 1, O and 0), costing under 0.1 bit per character, a small price for passwords you may have to read aloud or type from a printout.
Good password habits
- Use a password manager so you only have to remember one strong passphrase and never reuse anything.
- Turn on two-factor authentication for email, banking and social accounts, as a second layer beyond the password.
- Do not use personal information such as birthdays, pet names or phone numbers, even with substitutions like @ for a.
- Change a password after a breach notice or if you used it on a device that was lost or shared, not on a fixed schedule.
Accuracy and limits
The generator is as secure as your browser and device. A computer with malware, a malicious browser extension or a screen-recording tool can still capture what appears on screen. The strength meter is based only on length and pool size, so it assumes the password is truly random; do not type in your own password to test it. Some sites cap length or ban certain symbols, so adjust the settings to match.
Frequently asked questions
Is it safe to generate passwords in a browser?
Yes, when the page runs locally and uses the browser's secure random generator, as this one does. The password is never transmitted. Still, use a trusted device and paste the result straight into a password manager.
How long should a password be?
Sixteen random characters is a strong default for most accounts. Use 20 or more for your email, password manager and financial accounts, since those unlock everything else.
Do I need symbols in my password?
Not if the password is long enough. Length adds more strength than symbols, and some sites reject certain symbols. If a site does allow them, including them is a free boost.
Why avoid characters like l, I, 1, O and 0?
They look alike in many fonts, which causes mistakes when you read or type a password by hand. The option removes them at a small cost in strength, so use it for passwords you may need to write down.
Does this tool save or log my passwords?
No. Passwords are generated in your browser's memory and are gone when you close or refresh the page. Nothing is sent to a server.