Password Generator Online
Create a strong password right in your browser. It's generated on your device and never sent anywhere.
Where the randomness in this password generator comes from
Characters are drawn with crypto.getRandomValues, the random number generator the browser exposes for cryptographic work, seeded by the operating system. Math.random would have been the easy choice, and its output becomes predictable once you have seen enough of it. Each draw also uses rejection sampling, so a random 32-bit number that falls outside a clean multiple of the alphabet size is thrown away and another one is taken. The obvious shortcut of taking a remainder makes the first few characters of the pool more likely than the rest, which leaves an attacker fewer likely passwords to try.
How long a password needs to be
With lowercase, uppercase, digits and symbols all ticked the pool holds 86 characters, about 6.4 bits of entropy each, so a 16 character password carries roughly 103 bits and a 20 character one clears 128. No hardware that exists brute-forces numbers that size. Passwords this long leak through a breach at the other end, or through reuse. Sixteen is the sensible floor for an everyday login; go to 20 or beyond for email, banking and a password manager's master password, because those three can unlock most of your other accounts.
Symbols, look-alikes and sites that reject things
The symbol set here is the 24 characters most login forms accept. Some still refuse punctuation outright, and a few cap length at 12 or 16, in which case untick symbols or drag the slider down rather than editing the password by hand, which tends to produce something more guessable than what you started with. The look-alike option removes zero, capital O, digit one, lowercase L and capital I, which takes the pool from 86 characters to 81 and is worth the small loss for any password you will read aloud, dictate or type on a television remote.
After you copy the password
Once the password leaves this page the rest of the chain is out of its hands: the clipboard you paste through is readable by other software on the same machine, a keylogger or a compromised extension sees whatever you type, and a strong password reused on two sites is only as safe as the weaker of them. Store passwords in a manager rather than a notes file, turn on two-factor authentication wherever it is offered, and if you need to hand a Wi-Fi password to a guest, a QR code beats reading it out. To check a length limit before you submit, paste the string into the character counter.
Frequently asked questions
What makes a password strong?+
Length first, then variety, then never reusing it. With all four character sets ticked the pool is 86 characters, so 16 characters comes to roughly 103 bits of entropy and 20 clears 128. Nobody guesses a password that long. It gets stolen from a breached site, and that is why reuse matters more than any clever substitution.
How random are these passwords?+
Each character comes from crypto.getRandomValues, the browser's cryptographic random number generator, with rejection sampling on top. A plain remainder would bias the draw toward the first characters of the pool and shrink the search space an attacker has to cover.
Does the password reach your server?+
No. This page is a static file and the generator runs inside your browser tab, so no request carries the password anywhere, and we keep no account or log that could hold it. What happens after you paste it depends on your own device, which no web page can vouch for.
How long should I make it?+
Sixteen characters is a sensible floor for an ordinary account and it's where the slider starts. Go to 20 or more for email, banking and a password manager's master password, since whoever gets those can usually reach everything else. The slider runs from 4 to 64; the short end is there for systems with an old input limit, four characters is never a good idea.
Why would I remove look-alike characters?+
Zero and capital O, digit one and lowercase L and capital I are hard to tell apart in many fonts. Tick the option and all five are dropped from the pool, which is worth doing for a password you will read off a screen, dictate over the phone or type into a TV. It costs a little entropy: the pool falls from 86 characters to 81.
Is it free, and is there a limit?+
It's free and there's no cap on how many you make. Moving the slider or ticking a box generates a new password straight away, and the refresh button draws another one from the same settings.