Password Generator — strong random passwords online
Create strong random passwords with the length and character set you choose, including symbols and unambiguous characters. Generated locally, never stored.
About the Password generator tool
The passwords people invent are far weaker than they feel. Human choices cluster hard — a capital at the start, a digit and an exclamation mark at the end, a word from the dictionary in the middle, a date that means something. Attackers know this, and modern cracking tools model those patterns directly rather than trying every combination blindly, which is why a password that looks complicated can still fall in seconds.
Randomness is what defeats that, and it is the one thing a person cannot supply. A generated password has no pattern to model, so the only attack left is trying every possibility, and that is a matter of arithmetic. Length dominates the arithmetic: each additional character multiplies the search space, so a longer password from a smaller character set beats a short one bristling with symbols. Sixteen characters is a sensible floor for anything that matters, and twenty or more for the accounts everything else depends on.
The entropy figure shown alongside each password is that arithmetic made explicit — how many bits of genuine unpredictability it contains. Below 50 bits is weak against a determined attacker with a stolen hash database. Around 70 is comfortable. Above 100 is beyond any foreseeable brute-force capability. It is a far better guide than a coloured strength bar, because it measures the thing that actually matters rather than counting character types.
The excluding look-alikes option exists for a practical reason rather than a security one. Capital I, lowercase l and the digit 1 are indistinguishable in many fonts, as are capital O and zero, and that becomes genuinely painful when a password has to be read off a screen and typed into a device without a keyboard, dictated over the phone, or written down for a handover. It costs a little entropy and saves a great deal of frustration.
How it works
Set the length
Sixteen characters or more for anything that matters. Length contributes more strength than any other setting.
Choose the character set
Include lowercase, uppercase, digits and symbols, and exclude look-alike characters if it will be typed by hand.
Copy it into a manager
Take the password straight into your password manager. It is generated in your tab and never stored or sent.
Frequently asked questions
- How long should a password be?
- Sixteen characters is a reasonable minimum for ordinary accounts, and twenty or more for the ones that protect everything else — your email, your password manager, your bank. Length matters more than complexity, because each extra character multiplies the number of possibilities while adding one more symbol type only widens the alphabet slightly.
- What does the entropy number mean?
- It measures genuine unpredictability in bits. Each extra bit doubles the number of guesses required. Under 50 bits is weak against an attacker who has stolen a password database and can guess offline at enormous speed; around 70 is comfortable; over 100 is beyond any realistic brute-force attack. It is a far more honest measure than a colour-coded strength meter.
- Is a generated password really better than one I invent?
- Substantially, because human-chosen passwords follow patterns that cracking tools model explicitly — a capital first, digits and a symbol last, a dictionary word inside, a meaningful date. Substituting 3 for e and @ for a has been anticipated for decades. Random generation has no pattern to exploit, so the only attack left is exhaustive search.
- Should I exclude look-alike characters?
- Yes if a human will ever read or type it — an office Wi-Fi key, a device password, credentials handed to a colleague. Capital I, lowercase l, digit 1, capital O and zero are indistinguishable in many fonts. The small loss of entropy is easily recovered by adding a character or two, and it prevents a great deal of confusion.
- Is the password sent anywhere or stored?
- No. It is generated by your browser's cryptographic random number generator inside the tab, is never transmitted, never written to storage and never logged, and disappears when you close the page. Nothing about it is recoverable afterwards, by anyone including us — copy it into your password manager before navigating away.
- How is the randomness produced?
- From the browser's Web Crypto API, which draws on the operating system's cryptographically secure random source — the same one used for TLS keys. This is not the ordinary random function used for shuffling arrays, whose output is predictable from previous values and unsuitable for anything security-related.
- Do I need a different password for every account?
- Yes, and it is more important than the strength of any individual one. Breaches happen constantly, and attackers immediately try leaked credentials against other services — that single technique compromises more accounts than password cracking does. Unique passwords everywhere means one breach stays contained, which is only practical with a password manager.