Password Generator

What is the Password Generator?

The Password Generator creates strong, random passwords in your browser. Choose a length from 8 to 64 characters, tick which character types to include (uppercase, lowercase, digits, symbols), and get a password built from your device’s cryptographic random source. Nothing is sent to a server, nothing is stored, and you can copy the result with one click. A live strength meter shows the estimated entropy in bits so you can see how much a longer password or an extra character set actually adds.

How to use the Password Generator

1. Set the length with the slider. 16 is a sensible default for anything a password manager will store; 20 or more costs nothing extra.
2. Choose the character sets. Leave all four on unless the site you’re signing up to rejects symbols.
3. Turn on “exclude ambiguous characters” if the password will be read aloud or typed from a screen — it removes look-alikes such as l, 1, I, O and 0.
4. Click Generate. Click again for a fresh one; each result is independent.
5. Copy it straight into your password manager. Don’t reuse it anywhere else.

Features of this password generator

• Cryptographic randomness. Uses crypto.getRandomValues(), the same source browsers use for TLS, rather than a predictable pseudo-random function.
• Runs offline. Load the page, disconnect from the internet, and it still works — proof the password never leaves your device.
• Entropy meter. Shows bits of entropy and a plain-language rating, so “12 characters, letters only” and “12 characters, all sets” are visibly different.
• Passphrase mode. Generates four to eight random dictionary words for passwords you have to remember or type on a phone.
• Bulk generation. Produce up to 20 passwords at once for onboarding accounts or seeding a manager.
• No account, no watermark, no limits.

Why use a generated password instead of making one up?

Attackers don’t guess passwords one at a time; they crack leaked databases with GPUs that test billions of candidates per second, starting with every password that has ever appeared in a breach and every dictionary word with common substitutions. A password a person invents — a word, a year, an exclamation mark — sits near the top of that list. A random 16-character password from all four character sets has roughly 100 bits of entropy and is beyond any current hardware. The generator gives you that randomness without asking you to think of it, and a password manager means you never have to remember it.

For the full explanation of entropy, cracking speeds and how long each kind of password really holds up, read How Strong Does a Password Need to Be?.

Recommended settings

Use	Setting	Approx. entropy
Stored in a password manager	20+ chars, all sets	130+ bits
Typed occasionally (laptop, Wi-Fi)	Passphrase, 5–6 words	65–77 bits
Password manager master password	Passphrase, 6+ words, memorised	77+ bits
Site with a 12-character limit	12 chars, all sets	78 bits
Site that bans symbols	16+ chars, letters + digits	95 bits

Related tools

Encode or decode credentials for a config file with the Base64 Encoder & Decoder (remember, that isn’t encryption). Check a site’s security headers before trusting it with a login using the HTTP Header Checker. Validate a password-strength regex with the Regex Tester.

Frequently asked questions

Is it safe to generate a password online?

With this tool, yes. Generation happens in your browser with a cryptographic random source and the page makes no network requests after loading. You can verify by switching off Wi-Fi and generating again.

How long should a password be?

16 characters with all character sets for anything a manager stores; 12 is the practical minimum if it is genuinely random. Length matters far more than “complexity rules”.

Are passphrases as strong as random strings?

Per character no, per password yes because they are longer. A six-word random passphrase beats most random strings people are willing to type.

Should I change passwords regularly?

Only when there is a reason (a breach, a shared device, a suspected leak). Current NIST guidance dropped forced periodic changes because they push people towards weaker, patterned passwords.

Does the generator store the passwords it makes?

No. Nothing is logged or stored. Once you leave the page the password exists only where you pasted it.