Password Generator

Generate cryptographically secure passwords with guaranteed character variety and a real entropy score.

Security ToolsRuns in your browserFree, no sign-up

Options

Length

How many passwords

Lowercase (a–z)

Uppercase (A–Z)

Numbers (0–9)

Symbols (!@#$…)

Exclude look-alike characters

Removes I l 1 O 0 o and similar — useful when the password will be read aloud or typed from paper.

Generated passwords

Press Generate to create output.

Ctrl + Enter to run

About the Password Generator

Generates passwords from `crypto.getRandomValues`, the browser's cryptographically secure random source, rather than `Math.random`, whose output is predictable from prior values and unfit for anything security-related. Nothing is transmitted or stored.

Length matters more than character variety. A long passphrase beats a short string of symbols that is harder to type and easier to forget, and most modern guidance has moved to favouring length. If a site rejects a long password, that is a sign it is doing something wrong with storage.

Frequently asked questions

Are these passwords actually random?

Yes. They use crypto.getRandomValues(), the browser's cryptographically secure random number generator, with rejection sampling to avoid modulo bias. Math.random() — which many online generators use — is explicitly documented as non-cryptographic and must never be used for secrets.

Are the passwords sent anywhere?

No. Generation happens entirely in your browser and no request is made. This is non-negotiable for a password tool: a generator that transmits its output is generating passwords for someone else too.

How long should a password be?

For anything that matters, 16 characters or more from a mixed alphabet — that is roughly 100 bits of entropy, comfortably beyond offline brute force. The default of 20 gives about 128 bits. Length contributes far more than exotic symbols: a longer password from a smaller alphabet beats a short one with punctuation.

What does the entropy figure mean?

It is length × log2(alphabet size) — the number of bits of true randomness in the generation process, and therefore the log of how many guesses an attacker needs on average. Below 60 bits is weak against offline attack; 90+ is strong; 128 is beyond practical brute force. Note it measures the process, not the specific string.