How to use the Password Generator
- Choose Password for a random string of characters or Passphrase for a run of random words.
- Set the length (or number of words) and pick which character sets to include. A new password appears with every change.
- Check the strength meter and entropy figure, then click Copy and paste the password into the site or your password manager.
- Need several? Enter a number under Generate many at once to create a list you can copy or download.
Features
- Cryptographically secure randomness with no modulo bias
- Length from 4 to 128 characters with any mix of character sets
- Option to drop look-alike characters or any symbols a site rejects
- Passphrase mode with separators, capitals and an optional number
- Live entropy in bits with an estimated time to crack
- Bulk generation of up to 500 passwords as a list or .txt file
What makes a password strong
A password is strong when an attacker cannot guess it in any realistic amount of time. Attackers do not type guesses by hand; they run software that tries billions of candidates per second against a stolen database of password hashes, starting with leaked passwords, dictionary words and common patterns such as Summer2024!. The only reliable defense is a password that was chosen at random from a very large space of possibilities, which is exactly what this generator produces.
Entropy: measuring randomness
Strength is measured in bits of entropy. For a random password the formula is simple: entropy = length × log₂(pool size), where the pool is the number of characters that could appear in each position. Every extra bit doubles the number of guesses an attacker needs.
| Characters used | Pool size | Bits per character | 16 characters |
|---|---|---|---|
| Digits only | 10 | 3.3 | 53 bits |
| Lowercase letters | 26 | 4.7 | 75 bits |
| Upper + lower + digits | 62 | 5.95 | 95 bits |
| Upper + lower + digits + 28 symbols | 90 | 6.5 | 104 bits |
Notice that length matters more than variety. Adding four characters to a 16-character password adds about 26 bits, while switching on symbols adds fewer than 10. As a rule of thumb, aim for at least 70 bits for everyday accounts and 90 bits or more for your email, banking and password manager master password.
How this generator stays unbiased
Each character is chosen with crypto.getRandomValues, the cryptographically secure random number generator built into your browser. A common mistake in password tools is taking a random number and using the remainder after dividing by the pool size, which makes some characters slightly more likely than others. This tool uses rejection sampling instead: random values that would cause that imbalance are thrown away and redrawn, so every character in the pool has exactly the same chance. When you ask for at least one character from each set, one character is drawn from each set first, the rest from the full pool, and the result is shuffled with a cryptographically random Fisher–Yates shuffle so the guaranteed characters do not sit in predictable positions.
Passwords or passphrases?
A passphrase such as maple-harbor-violin-sprout-quiet is built from randomly chosen words. Each word from this tool’s list of more than 1,200 words adds about 10.3 bits, so five words give roughly 51 bits and seven words about 72 bits. Passphrases are much easier to type on a phone or TV and to remember, which makes them ideal for a password manager master password or a computer login. The words must be picked by the generator, not by you: people choose predictable words and phrases, which attackers try first.
Good habits
- Use a different password for every account, so one breach cannot unlock the others.
- Store passwords in a password manager rather than a document or sticky note.
- Turn on two-factor authentication wherever it is offered.
- Check passwords you already use with the Password Strength Checker.
Passwords are created in your browser and never sent anywhere. Only your option choices, not the passwords, are remembered on this device for your next visit.
Frequently asked questions
Are the passwords generated here safe to use?
Yes. They are created in your browser using its cryptographically secure random number generator, and they are never sent to a server or saved. Close the tab and they are gone.
How long should my password be?
For most accounts, 16 random characters with mixed sets is plenty. For a master password or encryption key, use 20 or more characters, or a passphrase of six or seven random words.
Why exclude look-alike characters?
Characters such as capital I, lowercase l and the number 1 are easy to confuse when you read a password aloud or type it from a printout. Excluding them costs a tiny amount of entropy, which you can recover by adding one more character.
What does “bits of entropy” mean?
It is the number of yes-or-no guesses needed to cover every possible password the generator could have produced. Each extra bit doubles the work for an attacker, so 80 bits is about a million times harder to crack than 60 bits.
Is a passphrase as secure as a random password?
It can be, if it is long enough. Each random word from this list adds about 10.3 bits, so a seven-word passphrase is roughly as strong as an 11-character password using letters, digits and symbols.