Password Generator

How to use

1. Choose a length from 4 to 128. The default is 16.
2. Leave all four character sets on unless a site forbids one of them.
3. Turn on “Exclude look-alikes” only if you need to read the password aloud or type it by hand.
4. Copy the password and store it in a password manager.
5. Press Regenerate for a different password. Changing any option also makes a new one.

What makes a password strong

Strength comes down to how many possible passwords an attacker would have to guess through — not how clever the password looks. A password's entropy, measured in bits, is simply its length multiplied by the log2 of how many characters each position could be. With all four character sets turned on, you're drawing from a pool of 88 characters, which works out to about 6.46 bits for every character you add.

That math adds up fast. An 8-character password from this pool carries about 52 bits of entropy. At 12 characters, that's 78 bits. At 16, it's 103 bits. At 20, it's 129, and at 24, it's 155. Each additional character makes a real difference — far more than swapping in an extra symbol here or there. On this page the labels read: under 40 bits Very weak, under 60 Weak, under 75 Fair, under 100 Strong, and 100 and over Very strong.

This lines up with current guidance from NIST (SP 800-63B, Revision 4, 2025), which recommends at least 15 characters when a password is your only way of signing in, or at least 8 when you're also using a second factor like an authenticator app. Length matters more than complexity rules, and a unique password for every account is what actually stops credential-stuffing attacks, where leaked passwords from one breach get tried against other sites. NIST no longer recommends forcing periodic password changes on a schedule — change a password when you have reason to believe it's been exposed, not just because a calendar says so.

If you'd rather use a memorable passphrase instead of a random string, a six-word passphrase drawn from a list of 7,776 words carries about 78 bits of entropy — which is solid, though this tool generates random character strings, not passphrases.

How this generator works

This generator runs entirely in your browser. The randomness comes from the Web Crypto API (crypto.getRandomValues), the cryptographically secure random number generator built into every modern browser — never Math.random(), which is predictable and unsuitable for security. Characters are picked with rejection sampling, so every character in the pool has an exactly equal chance of being chosen, with no statistical bias toward any letter, number or symbol.

Nothing about the password you generate is sent anywhere, stored anywhere, or logged anywhere by us. There is no account, no registration and no cloud sync. Your password history is stored only in your browser's local storage on your own device, and you can clear it at any time.

You don't have to take our word for it:

• Load the page, then disconnect from the internet — the tool keeps working, because nothing here depends on a network connection.
• Open your browser's developer tools, switch to the Network tab, and generate a few passwords — no requests go out.

The crack-time estimate is a theoretical figure based on the stated assumptions, not a prediction of how long an individual account will remain secure.

Password length and strength

All four character sets on (88-character pool):

Crack time assumes an attacker who has already stolen a fast-hashed password database and can try 1 trillion guesses per second, searching half the possible space on average — at 16 characters that works out to roughly 205 billion years. An online attack against a live login is far slower, and a properly slow password-hashing algorithm (like bcrypt) slows the attacker down even more. With look-alikes excluded, the pool shrinks to 82 characters, about 6.36 bits per character — so a 16-character password in that mode carries about 102 bits.

Password generator, answered

Related tools

By Moein Shahidi, maker of RahaKit.