Password Generator

How to use the password generator

1. A new 16-character password appears as soon as the page loads. Click Copy and paste it where you need it.
2. Drag the slider or type a length between 4 and 128 characters. Every change creates a fresh password.
3. Choose the character types: uppercase, lowercase, numbers and symbols. The generator always includes at least one character from each type you select, so the password passes sites that demand "one number and one symbol".
4. Turn on Exclude look-alike characters if you will ever read the password aloud or type it by hand. It removes I, l, 1, O, 0, o and quote marks.
5. Click Generate new until you get one you like, then store it in a password manager.

How the passwords are created

Each character is picked with crypto.getRandomValues, the browser's cryptographically secure random number generator. Ordinary functions such as Math.random are predictable and must never be used for secrets. To keep every character equally likely, the generator uses rejection sampling instead of a simple remainder, which would make some characters slightly more common. If a finished password happens to miss one of the character types you selected, it is thrown away and a new one is drawn. The result: every password that fits your settings is exactly as likely as any other. Nothing leaves your device.

Password strength and entropy

Strength is shown in bits of entropy: the base-2 logarithm of how many different passwords your settings can produce. Each extra bit doubles the number of guesses an attacker needs. For a completely free random string the textbook formula is length × log₂(character set size); with all four types the set has 89 characters, so each character adds about 6.5 bits. Requiring at least one character of every selected type rules out some combinations, so the tool subtracts that exactly. The effect is large only for short passwords: at 4 characters it is 22.1 bits instead of 25.9, at 16 characters 103.4 instead of 103.6.

• Below 36 bits: weak. Fine only for throwaway PINs.
• 36–59 bits: fair. Resists online guessing, where sites limit login attempts.
• 60–127 bits: strong. Good for almost every account.
• 128 bits or more: very strong, comparable to a 128-bit encryption key.

Worked example: why length matters

Imagine a leaked password database and an attacker testing 100 billion guesses per second on a rig of graphics cards. On average they find a password after trying half of all combinations. For fully random passwords:

• 8 lowercase letters (37.6 bits): about 1 second.
• 8 letters and numbers (47.6 bits): about 18 minutes.
• 12 letters and numbers (71.5 bits): about 500 years.
• 16 characters of all types (103.6 bits): about 2.5 trillion years.

Going from 8 to 16 characters did far more than adding symbols ever could. That is why the default here is 16; this generator's 16-character passwords have 103.4 bits, about 2 trillion years at that speed.

Tips for using strong passwords

• Use a different password for every site. When one site is breached, attackers try the same email and password everywhere else.
• Let a password manager remember them. Bitwarden, 1Password and the managers built into browsers and phones store and fill long random passwords for you.
• Turn on two-factor authentication for email, banking and social accounts. Even a perfect password can be phished.
• Need to remember one? For the master password of your manager, use 5–6 random words (a passphrase) instead; it is long, strong and easier to type.
• Avoid edits of old passwords. "Summer2025!" to "Summer2026!" is the first thing cracking tools try.

Frequently asked questions