Password Generator

Generate strong random passwords with your own length and character rules, and see their entropy. Runs entirely in your browser. Nothing is sent to any server.

Options

Length

Character types Lowercase (a-z) Uppercase (A-Z) Digits (0-9) Symbols (!#$%…)

Exclude ambiguous characters

Leaves out 0, O, 1, l and I, which are easy to confuse.

At least one of each selected type

How many

Passwords

Excellent 130 bits of entropy · 90 possible characters

Select at least one character type

How this generator works

Every character is drawn from your browser's cryptographic random number generator, the same source used for TLS keys, not from Math.random. Draws that would fall outside a whole multiple of the alphabet size are rejected and redrawn, so no character is even slightly more likely than another: a subtle bias here is what makes otherwise long passwords easier to guess. Nothing is generated on a server, nothing is logged, and nothing is sent anywhere. Reload the page and the passwords you saw are gone for good.

How much entropy is enough?

Entropy measures how many guesses an attacker needs, on average, expressed in bits: each extra bit doubles that number. It depends only on the length and the size of the character set, never on whether a password 'looks' random.

< 40 bits

Guessable by an offline attacker in minutes. Fine for nothing.

40 - 59 bits

Holds up to casual attacks, not to a leaked password database.

60 - 79 bits

A reasonable target for an account you care about.

80+ bits

Out of reach of brute force with current and foreseeable hardware.

The figure shown by this tool is an upper bound: with 'at least one of each type' enabled, the guaranteed characters constrain the space slightly. The difference is a fraction of a bit at normal lengths, and the option is worth keeping when a site enforces composition rules.

Examples

Generating a password correctly in code means reaching for the cryptographic random source, not the general-purpose one:

JavaScript

const bytes = new Uint32Array(1);
crypto.getRandomValues(bytes);
// reject and redraw above the largest multiple of the alphabet size

Python

import secrets, string

alphabet = string.ascii_letters + string.digits
"".join(secrets.choice(alphabet) for _ in range(20))

Java

SecureRandom random = new SecureRandom();
int index = random.nextInt(alphabet.length());

import "crypto/rand"

n, _ := rand.Int(rand.Reader, big.NewInt(int64(len(alphabet))))

PHP

$index = random_int(0, strlen($alphabet) - 1);

Shell

LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 20

Use Cases

Service accounts and API credentials

Machine-to-machine credentials are never typed by a human, so there's no reason to keep them short or memorable. Generate the longest string the other system accepts and store it in a secret manager.

Database and admin passwords

Generate with symbols excluded when the password has to survive a connection string, a YAML file or a shell command, where quoting rules can mangle it.

Wi-Fi and shared passphrases

Turn on 'exclude ambiguous characters' for anything someone will read off a screen or a printed card. A password that can't be transcribed correctly gets replaced by a weaker one.

Seeding a password manager entry

Generate a batch, use one, and let the rest disappear when you close the tab. Useful when setting up several accounts in one sitting.

Frequently Asked Questions

Are these passwords sent to a server?

No. They are generated in your browser by JavaScript on this page, using the built-in Web Crypto random number generator. This site is static: there is no backend that could receive them, and nothing is stored in your browser either.

How long should a password be?

With all four character types enabled, 16 characters gives you about 105 bits of entropy, which is comfortably beyond brute force. Below 12 characters you start depending on the attacker not having a fast offline copy of the hash. If a site allows more, longer costs you nothing when a password manager does the typing.

Is a random password better than a passphrase?

For anything a password manager fills in, yes: it's shorter for the same entropy. For the handful of passwords you must type from memory, such as your device login or the manager's own master password, a passphrase of several random words is far easier to remember at comparable strength.

Why exclude quotes and backslashes from the symbols?

Because those are what break a password after you've already saved it. A quote or backslash pasted into a shell command, a connection string, a YAML file or a CSV import gets interpreted rather than stored. Leaving them out costs about half a bit per character and removes a whole class of failures.

Does 'at least one of each type' make the password weaker?

Very slightly, because it rules out the combinations that happen to omit a type. At 16 characters the difference is well under a bit, which is nothing next to the benefit of passing composition rules on the first try. The entropy shown is the unconstrained figure, so it's an upper bound.

Can I get the same password twice?

Only by chance, and with any reasonable length that chance is negligible: nothing is stored or reused between generations. Every character of every password is a fresh draw.