Free tool · runs in your browser
Password Generator
Create random passwords with the character sets you need. Each option is generated locally with the browser's cryptographic random number generator.
Entropy is what makes a password strong
A password's strength is measured in bits of entropy: roughly the length multiplied by the base-2 logarithm of the number of possible characters. A 20-character password drawn from 94 printable ASCII characters has about 131 bits. A 12-character one has about 79 bits.
Length buys more strength than clever substitutions. P@ssw0rd! is long enough to feel safe but short enough to fall to dictionary and rule-based attacks. A random 20-character string from the full set is not guessable that way.
Passwords or passphrases
Random character strings are excellent when a password manager fills them in. For the few secrets you must type by hand — a device login, a master password — a passphrase of four to six randomly chosen words is easier to enter and still strong. Four words from a 7,776-word list gives about 51 bits; six gives about 77. Add a number or symbol only if a site requires it.
What this generator guarantees
- At least one character from each selected set, so the result matches typical password policies.
- Randomness from
crypto.getRandomValues, notMath.random. - Five separate options per run, so you can pick one instead of accepting the first pattern.
- An entropy estimate in bits, updated with length and character sets.
- An option to remove visually ambiguous characters (I, l, 1, O, 0, o).
Frequently asked questions
Is this password generator safe to use?
Yes. Passwords are generated in your browser with the Web Crypto API and are never transmitted. The page does not log or store them; copy what you need before leaving.
How long should a password be?
Sixteen characters or more is a good default; this tool starts at 20. Aim for at least 90 bits of entropy for important accounts and 128 bits for password-manager or email master passwords.
Do I need symbols and numbers?
Only if a site requires them. Random length contributes more entropy than a required symbol. If a site rejects symbols, deselect that set and add a few characters instead.
Should I reuse a generated password?
No. Use a unique password per account and store it in a password manager. Reuse is what turns one breached site into many compromised accounts.
Why do I get five passwords at once?
Multiple candidates make it harder to unconsciously pick a familiar-looking pattern. They are all equally random; choose any one.
Can I use these passwords for banking?
Yes, as long as you save them in a reputable password manager or written vault. The generator itself has no knowledge of which site the password is for.