Password Generator
Generate passwords using a cryptographically secure RNG (Web Crypto API). Fine-grained control over character sets, length, and ambiguous-character exclusion, plus a strength meter.
Uses cryptographic RNG (crypto.getRandomValues); passwords never leave your browser.
About security
- This tool uses
crypto.getRandomValues()for cryptographically secure randomness. - Generation runs entirely in the browser; passwords are never sent to a server.
- 12+ characters with all four character types and no exclusion is recommended; for critical accounts, use 16+.
- Always store generated passwords in a safe place (e.g. a password manager).
Copied
📖 Where people get stuck
Generates passwords from cryptographically secure randomness via crypto.getRandomValues() in the Web Crypto API, with control over character sets, length and the exclusion of lookalike characters, and an entropy estimate. Everything runs in the browser and nothing is transmitted. The strength meter reports entropy — a measure of how many guesses would be needed — not how hard the password is to break in practice. Real safety is decided by where and how you store it, and whether you reuse it.
| Case | What happens | What to do |
|---|---|---|
| Believing complexity is what makes it strong | Entropy comes from both the size of the character set and the length, but they do not contribute equally: adding character types buys a few more bits per character, whereas each extra character adds that whole per-character amount again. Work it through and twelve lowercase letters (about 56 bits) beats eight characters using all four types (about 52 bits). Many sites nonetheless demand at least one uppercase, one digit and one symbol, and the result is a flood of memorable, weak passwords along the lines of Password1!. |
Favour length. With a password manager you never have to remember it, so twenty or more random characters costs you nothing — copying and pasting is the same effort at any length. For the handful you must remember — the device login, the manager master password — a passphrase of four to six unrelated words gives both memorability and strength. The 2017 revision of NIST SP 800-63B dropped both composition requirements and forced periodic rotation from its recommendations, asking instead for length and a check against a blocklist of breached passwords. If you are the one writing the requirements, replace them with those two. |
| Excluding lookalike characters weakens it | Excluding 0 against O, and 1 against l and I, reduces misreadings, but it shrinks the character set and lowers the entropy per character — drop five characters from the 62 alphanumerics and you have 57, costing a little over two bits across sixteen characters. The loss itself is small; the problem is that the reason for excluding them is easily forgotten. For a password you will only ever copy and paste, excluding lookalikes buys no legibility at all and costs entropy for nothing. |
Switch it by use. Excluding lookalikes matters only where a human reads the characters: printing it out to hand over, reading it aloud, typing it into another device by hand — an initial password sent by post, a device configured on site. If it is going into a password manager and being pasted, turn the exclusion off and spend the difference on one or two more characters. The point is to decide first whether anyone might type it by hand, and choose the setting from that; enabling the exclusion because it vaguely feels safer is a choice that runs against its own purpose. |
| Generating a strong password and then reusing it | The strength of a reused password is set by the weakest site that stores it. However long and complex it is, if one site keeps it in plain text and is breached, that string is the key to every other account. This is credential stuffing: taking leaked email and password pairs and trying them automatically across other services. The success rate is a few percent, but the attempts are automated, so across tens of millions of pairs plenty of accounts fall. The strength of the generated password is no defence against this at all. | Use a different password for every site — which is effectively the same as saying use a password manager. Nobody can memorise dozens of random strings, so a manager is the only way to actually achieve not reusing them. On top of that, enabling two-factor authentication has an even larger effect: a leaked password alone no longer gets anyone in. A realistic order of work is to turn on 2FA for the important accounts first — email, banking, the password manager itself — and then work through eliminating reuse. Put the email account at the very front: password resets for every other service arrive there, so it is effectively the key to all of them. |
A generated password ends up in more places than you expect. Copying it puts it on the clipboard, and with Windows clipboard history or the macOS and iPhone universal clipboard enabled, it syncs to other devices too — and in principle any application can read the clipboard. For passwords that genuinely matter, use the generator built into your password manager: generation and storage happen inside one application, touching neither the clipboard nor a browser. This page earns its place where a manager is not available: initial device setup, a temporary credential you are handing to someone, test data. One more piece of practical judgement worth carrying: when a signup form tells you that symbols are not allowed or that the maximum is twelve characters, that is a sign the site stores passwords in plain text or something close to it. Hashed properly, the length and character set of the input have no bearing on the length of the hash, so there is no reason to restrict them. On such a site, using a password you use nowhere else matters more than usual.
📖 How to Use
-
1
Set character types and lengthCheck the character types to include (uppercase, lowercase, numbers, symbols) and adjust the length slider (4–64). For important accounts, 16+ characters is recommended.
-
2
Set count and click GenerateEnter a count (1–50) and click Generate. Each result shows an entropy estimate and a strength label.
-
3
Copy and store the passwordClick the Copy button on each row to copy to clipboard. Store it in a password manager before closing the page.
❓ Frequently Asked Questions
Does this tool use truly random numbers?
What does "exclude similar characters" do?
Are generated passwords sent to a server?
🐛 Found a bug or issue with this tool?
Free to use, no signup. Even just the steps to reproduce are helpful. Reports go directly to the operator and help us fix issues.
Thanks for your report!
Your report has been delivered to the operator and will be used to improve the tool.