Password Generator
Build strong, random passwords right in your browser. Every character comes from a cryptographically secure source, with a live entropy read-out so you can see exactly how tough each password is to crack.
Loading…
Password generation, explained
Are these passwords generated securely?+
Yes. Every character is chosen with crypto.getRandomValues, the browser’s cryptographically secure random source, using rejection sampling so no character is more likely than another. This tool never uses Math.random.
Does anything I generate get sent to a server?+
No. The whole tool runs in your browser. Passwords are created locally and are never uploaded, logged, or stored. Close the tab and they are gone.
What does the strength read-out mean?+
It estimates entropy in bits as length multiplied by log2 of the character pool size. More bits means harder to guess. As a rough guide, under 40 bits is weak, 60 or more is strong, and 120 or more is very strong.
What does "exclude ambiguous characters" do?+
It removes look-alike characters that are easy to misread or mistype: capital I, lowercase l, the digit 1, capital O, and the digit 0. This is useful for passwords you will read aloud or copy by hand.
How long should my password be?+
For most accounts, aim for at least 16 characters with a mix of character types. For high-value logins use 20 or more. Length matters more than complexity, so a longer password with fewer symbol types is still very strong.
Related tools
All tools →More in General Tools.