A password generator produces long, unpredictable passwords that are far harder to guess or brute-force than anything a person would invent. The tool above builds each password in your browser using cryptographically secure randomness: pick a length, choose which character sets to include, and copy the result. Nothing is transmitted anywhere — the password never leaves your device.
Why random passwords beat memorable ones
Passwords people choose tend to follow patterns: a name, a word, a date, a predictable substitution like a zero for an O. Attackers know these patterns and encode them into their cracking tools, so a “complex-looking” human password is often weak in practice. A password made of truly random characters has no pattern to exploit, which is why the only thing that matters for its strength is the size of the character pool and the length.
What entropy means
Strength is measured in bits of entropy, calculated as length × log2(poolSize). Each bit doubles the number of possible passwords an attacker must try. The status line under the tool shows the exact figure for your current settings, along with a plain-language label:
| Entropy | Label | Rough meaning |
|---|---|---|
| under 28 bits | Very weak | Guessable quickly; avoid. |
| 28–35 bits | Weak | Only for throwaway use. |
| 36–59 bits | Fair | Okay for low-value accounts. |
| 60–127 bits | Strong | Good for everyday accounts. |
| 128 bits and up | Very strong | Suitable for master and high-value passwords. |
As a rule of thumb, a 16-character password using lowercase, uppercase, digits, and symbols is already above 100 bits — comfortably beyond what any current attacker can brute-force.
How this generator avoids bias
Many naive generators take a random byte and use the remainder operator (byte % poolSize) to pick a character. When the pool size does not divide evenly into 256, that method makes some characters slightly more likely than others — a flaw called modulo bias that quietly weakens the output. This tool uses rejection sampling instead: it discards the rare random values that would fall outside a clean multiple of the pool size, guaranteeing every character is equally probable. The randomness itself comes from crypto.getRandomValues, the browser’s cryptographically secure generator, not Math.random.
Choosing your settings
- Length — the single biggest lever. Longer is stronger; use the slider up to 64 characters.
- Character sets — enabling more sets grows the pool and adds entropy per character. Some sites restrict which symbols they accept, so you can turn symbols off if needed.
- Exclude look-alikes — removes characters like
I l 1 O 0 othat are easy to misread. Handy if you might type the password by hand; unnecessary if a password manager fills it for you.
Storing passwords the right way
Generating a strong password is only half the job. The safe place to keep it is a password manager, which encrypts your credentials, fills them automatically, and lets you use a unique password for every account without memorising any of them. Do not save passwords in a plain text file, a spreadsheet, or a sticky note, and never reuse the same password across sites — a single breach elsewhere would then unlock everything.
Privacy
This tool runs entirely in your browser. There is no server round-trip, no logging, and no third-party analytics on this page, so the passwords it produces are seen only by you. Even so, it is good practice to be cautious with any online generator: once this page has loaded you can disconnect from the network and it will keep working, and the source is available so you can confirm exactly what it does.