Password Generator

How to generate a strong password

1. Drag the Length slider anywhere from 4 to 64 characters. A new password appears as you move it.
2. Choose the character sets: A–Z, a–z, 0–9 and Symbols. Every set you tick is guaranteed to appear at least once, which satisfies sites that demand “one uppercase letter, one number and one symbol”. If you untick everything, lowercase letters are switched back on.
3. Tick Avoid look-alike characters if you will ever read the password aloud or type it from paper.
4. Click Copy and paste the password into the sign-up form and your password manager. ↻ creates another; Generate 10 passwords produces a list with a Copy all button.

The colored bar and label under the password estimate its strength from the length and the size of the character pool.

What the options contain

With all four sets the pool has 87 characters. The look-alike option removes I, l, 1, O, 0 and o, leaving 81. Quotes, backslashes, spaces and the backtick are left out; those are the characters most likely to be rejected by forms or to need escaping in command lines and configuration files.

How the passwords are made

Each character is chosen with crypto.getRandomValues, the browser’s cryptographically secure random number generator, not the predictable Math.random. Random values that would favor some characters over others are discarded and redrawn, so every character in the pool is equally likely. After one character from each chosen set has been placed, the rest are drawn from the whole pool and the result is shuffled, so the guaranteed characters don’t sit in predictable positions.

Generation happens on your own device. The password isn’t transmitted or saved by this page, and a new one replaces it as soon as you change a setting – so copy it into your password manager before you move on.

What “bits of entropy” means

Entropy expresses how many guesses a brute-force attack needs. A password chosen uniformly from N possibilities has log₂ N bits; every extra bit doubles the work. For random characters that is length × log₂(pool size). The tool rounds this figure and labels it: under 40 bits is Weak, 40–59 Fair, 60–79 Strong and 80 or more Very strong. Because each chosen set is forced to appear, the true value is very slightly lower than shown; at normal lengths the difference is negligible.

To make the numbers concrete, suppose an attacker who has stolen a database can test ten billion guesses per second. Trying every 40-bit password then takes under two minutes, 60 bits about 3.7 years, and 80 bits nearly four million years. Notice also that length beats variety: 16 lowercase letters (75 bits) are stronger than 8 characters from all four sets (52 bits).

These figures apply only to randomly generated passwords. A password you invent, such as Summer2026!, has far less real entropy than its length suggests, because attackers try words, names, dates and common substitutions first.

Choosing settings in practice

• Accounts in a password manager: 20 characters or more with all sets. You never type them, so length costs nothing.
• Passwords you type by hand, such as a Wi-Fi key or a computer login: 16+ characters, look-alikes avoided, symbols optional – add length instead.
• Sites with odd rules: if a form rejects certain symbols, untick Symbols and add four or five characters to keep the strength.
• Numeric PINs are a different case: a 6-digit PIN has under 20 bits and relies on lock-outs after a few wrong tries, not on entropy. The random number generator can pick one.

Password habits that matter more than the generator

• Use a different password for every account. Credential-stuffing attacks reuse passwords leaked from one site on many others.
• Keep them in a password manager rather than a document or spreadsheet.
• Turn on two-factor authentication, preferably an authenticator app or security key, for email, banking and anything that can reset other accounts.
• Change a password when there is a reason – a breach, a shared device – rather than on a fixed schedule. Current NIST guidance (SP 800-63B) also favors length over forced complexity rules.

FAQ

Is a passphrase better than a random password?

It can be easier to remember for the same strength. Six words chosen at random from a 7,776-word list give about 77.5 bits, comparable to a 12-character password using all sets. The words must be picked randomly, not chosen by you.

How long should a password be?

For accounts you care about, aim for at least 80 bits, which means 13 or more characters with all sets, or 18 or more with lowercase letters alone.

Why does the website still call my password weak?

Some sites use simple rules, such as requiring a symbol, rather than measuring randomness. Make sure the sets they ask for are ticked.