Password Generator
Create a strong random password using your browser’s cryptographic random number generator. Nothing is stored, logged or transmitted — close the tab and it is gone.
Drawing from 85 possible characters. Length raises strength faster than anything else here.
How to use Password Generator
- Choose a length. Longer is the single biggest win; 16 characters or more is a good target.
- Pick which character types to include.
- Press Generate, then copy the result straight into your password manager.
- Generate a fresh one for every account — never reuse a password.
About this tool
Passwords here come from the Web Crypto API (crypto.getRandomValues), the same source browsers use for cryptographic keys. The ordinary Math.random() function is explicitly not used anywhere in this tool: it is fast but predictable, and sequences generated from it can be reconstructed by an attacker who sees earlier output.
Picking characters from a pool is also done carefully. Taking a random number modulo the pool size quietly biases the result toward the first characters in the pool, so this tool discards and redraws values that would land in the biased tail. The shuffle that distributes the guaranteed character types across the password uses the same unbiased draw.
The strength figure shown is entropy in bits: the base-2 logarithm of how many passwords could have come out of the settings you chose. It describes the generator, not your habits. A 70-bit password is still worthless if it is reused on a site that gets breached, or if it is typed into a convincing phishing page.
Frequently asked questions
Is it safe to generate a password on a website?
It depends entirely on where the generation happens. This page does it locally in JavaScript — there is no network request involved in producing a password, which you can confirm by opening your browser’s network panel while you click Generate. A generator that produced passwords on a server would be a genuinely bad idea.
How many bits of entropy do I need?
Roughly: under 50 bits is weak against a determined attacker with stolen password hashes, 60–80 bits is fine for ordinary accounts protected by rate limiting, and 100+ bits is appropriate for a password manager master password or an encryption key. Length raises entropy faster than exotic characters do.
Why would I exclude similar-looking characters?
Because of 1, l, I, 0 and O. If a password will ever be read off a screen and typed by hand, or dictated over the phone, excluding those avoids a lot of failed logins. It costs a few bits of entropy, which you can recover by adding one more character of length.
Are generated passwords stored anywhere?
No. They exist in the page’s memory until you navigate away or reload, and in your clipboard if you copy one. There is no database, no analytics and no logging on this site. Save the password in a password manager before leaving the page.