Password Generator
This free password generator creates strong, random passwords entirely in your browser. Choose a length from 4 to 64 characters, pick which character types to include, and optionally exclude ambiguous characters like 0/O or 1/l/I. A real-time strength indicator shows how strong your current settings produce, and you can copy the result with one click.
How to Use It
- Adjust the length slider (4 to 64 characters, longer is stronger).
- Toggle which character types to include: uppercase, lowercase, numbers, and symbols.
- Optionally exclude ambiguous characters (0/O, 1/l/I) if you'll need to type the password manually.
- Click "Generate New Password" for a fresh one, or copy the current one with the Copy button.
How It Works
Every password is generated using your browser's Web Crypto API (crypto.getRandomValues()), the same cryptographically secure random number source used for security-sensitive operations, never the predictable Math.random(). Each character is chosen using rejection sampling to avoid the subtle statistical bias that a naive random-index calculation can introduce, so every allowed character is equally likely to appear.
The strength indicator estimates entropy, the number of bits of randomness in the password, based on its length and the size of the character set you've selected. More length and more character types both increase entropy, but length has a bigger effect: each extra character multiplies the total number of possible passwords, while an extra character type only adds a fixed, smaller multiplier.
A worked comparison: an 8-character password using all four character types draws from a pool of 88 possible characters, giving about 51.7 bits of entropy: "Fair" on the scale here. A 16-character password using lowercase letters only draws from a much smaller pool of 26 characters, but at double the length, that comes to about 75.2 bits: "Strong." Doubling the length more than made up for using a far smaller character set, which is the concrete version of "length matters more than complexity" above.
Everything happens on your device. No password this tool generates is ever sent over the network, logged, or stored anywhere.
Frequently Asked Questions
What makes a password strong?
A strong password is long and unpredictable, generated randomly rather than based on words, names, or patterns you'd recognize. Strength is really about how many possible passwords an attacker would have to try before guessing yours (its entropy), not about memorizing something clever.
Why does length matter more than complexity?
Each additional character multiplies the number of possible passwords, while adding a new character type (like symbols) only multiplies it by a small, fixed amount. A longer password made of just letters and numbers is often far stronger than a short one stuffed with symbols. When in doubt, make it longer.
Is this password generator actually secure?
Yes. It uses your browser's cryptographically secure random number generator (crypto.getRandomValues), never the weaker Math.random(), and every password is generated entirely on your device. Nothing you generate here is sent to a server, logged, or stored.
Should I exclude ambiguous characters like 0/O or 1/l/I?
Only if you're going to type or read the password somewhere those characters are hard to tell apart, like on paper or a low-resolution screen. It slightly reduces the character pool, so leave it off for maximum strength if you'll be copying and pasting the password instead of typing it.
What is entropy, exactly?
Entropy measures how many possible passwords could result from your chosen length and character set, expressed in bits. Each additional bit doubles the number of possibilities an attacker would need to guess through. It's calculated as length × log₂(character set size). A 16-character password using all four character types (88 possible characters) has about 103 bits of entropy, which this tool labels "Strong."
Should I reuse a strong password across multiple sites?
No. A password's strength only protects against guessing attacks. It does nothing if the site itself is breached and your password leaks in plain or weakly-hashed form. Reusing even a very strong password across sites means one breach anywhere can compromise every account using it. A password manager that generates and stores a unique password per site is the standard way to avoid this.
Does a longer password always beat a shorter one with more character types?
Not automatically, but length usually wins by a wide margin. An 8-character password using all four character types (uppercase, lowercase, numbers, symbols) has about 52 bits of entropy: "Fair" on the strength scale here. A 16-character password using lowercase letters only has about 75 bits: "Strong", despite using a much smaller character set. Doubling the length outweighed quadrupling the character-type variety.
Can this generator create a password I'll be able to remember?
Not by design: a truly random password, which is what maximizes security, is intentionally not memorable. If you need a password you can recall without a password manager, a passphrase of several random unrelated words is a common alternative approach, though it isn't what this specific tool generates. For anything account-security-sensitive, pairing a generated password like this one with a password manager is the more common recommendation.