Password Generator
Generate random passwords from your browser's cryptographic random number generator, choose exactly which characters go in, and see how many bits of entropy the result has.
Options
Between 4 and 128 characters.
Passwords are generated inside your browser and are never sent to our server or stored by this page.
How to use the Password Generator
- Set the length with the slider or type a number. The password updates straight away.
- Tick the character sets you want. If a site rejects certain symbols, untick Symbols and add a few characters of length instead.
- Turn on Leave out look-alikes if you will ever read the password aloud or type it from paper.
- Press Copy, paste the password into the sign-up form, and save it in your password manager before you leave the page.
How the passwords are made
Each character is picked with crypto.getRandomValues(), the cryptographically secure random number generator built into modern browsers. A common mistake is to take a random number and use the remainder after dividing by the number of characters. Unless the range divides evenly, that makes the first few characters slightly more likely than the rest. This tool uses rejection sampling instead: any random value that would cause that imbalance is thrown away and a new one drawn, so every allowed character has exactly the same chance.
When you ask for at least one character from every set, the tool does not slip a digit or symbol into a fixed position. It generates a complete password and, if a set is missing, starts again. That way no position is predictable and every password that meets the rule is equally likely.
What the entropy figure means
Entropy is the number of bits needed to describe how many equally likely passwords the settings could produce. With 20 characters drawn from 89 possibilities you get 20 × log₂(89) ≈ 129.5 bits. Each extra bit doubles the number of guesses an attacker would need to try every option. One character more adds log₂ of the pool size, which is why length usually adds more than another character type.
The figure describes the generator, not the text itself. A password you invent yourself does not have this much entropy just because it is long or mixed, since people choose patterns. And the rule "at least one of each set" removes some combinations, so the simple formula is then an upper bound. The tool also shows the exact value for that case, counted with the inclusion–exclusion principle.
How long should a password be?
The US National Institute of Standards and Technology (NIST) sets rules for services that check passwords. In SP 800-63B-4, section 3.1.1.2, it says verifiers shall require at least 15 characters for a password used as the only authentication factor and at least 8 when it is part of multi-factor authentication. It also says they should allow passwords of at least 64 characters, and that they shall not impose composition rules such as requiring a mix of character types. Those are requirements for websites, not for you, but they are a sensible reference point: if a site lets you, go for 15 characters or more and use a password manager so you never have to remember them.
Frequently asked questions
Is it safe to generate a password on a website?
This page creates passwords with JavaScript in your browser and does not send them anywhere or store them. You can check by opening your browser's developer tools and watching the network tab while you generate. Still, treat any copied password carefully: it stays on your clipboard until you copy something else.
Why not use Math.random()?
Math.random() is designed for things like games and animations. It is not meant to be unpredictable to an attacker. crypto.getRandomValues() is the browser's cryptographically secure source, which is what you want for passwords.
Should I include symbols?
Symbols enlarge the pool from 62 to 89 characters, adding about half a bit per character. Adding characters of length gives you about the same gain, so if a site refuses symbols, simply make the password a few characters longer.
What does "leave out look-alikes" remove?
The capital letters O and I, the lowercase letters o and l, and the digits 0 and 1. That makes the password easier to read aloud or type from a printout. The pool gets smaller, and the entropy figure updates to show the cost.
Does the tool offer passphrases?
Not at the moment. A good passphrase generator needs a large published word list built for that purpose, and we would rather not offer one with a home-made list. A long random password stored in a password manager covers most needs.
Can I generate several passwords at once?
Yes. Choose 5, 10 or 20 under How many passwords. Each one is generated independently with the same settings and has its own Copy button.
Sources: NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, section 3.1.1.2 Password Verifiers; MDN Web Docs: Crypto.getRandomValues()