How to use Password Generator
- 1Set the password length with the slider
- 2Turn character sets on or off
- 3Optionally exclude look-alike characters
- 4Choose how many passwords to generate
- 5Copy the password you want
What Password Generator does
A password's strength comes from how many guesses an attacker would need, and that depends on two things only: its length and the size of the alphabet it was drawn from. Human-chosen passwords score badly on both, because people pick words, dates and patterns that cracking tools try first. A password drawn at random has no pattern to exploit.
This generator uses crypto.getRandomValues, the cryptographically secure random source built into every modern browser, rather than Math.random, which is predictable. Each character is picked with rejection sampling so no character is more likely than any other, and every character set you switch on is guaranteed to appear at least once.
When to use it
- Filling a password manager
- When a password manager stores the result, length costs you nothing. Generate 24 or more characters with every set enabled and you will never need to type or remember it.
- Wi-Fi and router passwords
- Router admin pages and Wi-Fi keys are attacked offline, so they need real length. Turn on look-alike exclusion if guests will type the key from a card.
- Sites with strict password rules
- Some services demand a symbol or forbid them. Toggle the sets to match the rule, and the guaranteed-inclusion step ensures the password passes a 'must contain' check first time.
Password Generator settings explained
- Length
- From 8 to 128 characters. Each extra character multiplies the number of possible passwords by the alphabet size, so length is the single most effective setting.
- Character sets
- Uppercase, lowercase, numbers and symbols. All four together give an alphabet of 89 characters. Each enabled set is represented at least once.
- Exclude look-alike characters
- Removes I, l, 1, O, 0, o and similar characters that are easy to misread on paper or in some fonts. It shrinks the alphabet slightly, which the entropy readout reflects.
- How many
- Generates up to 20 passwords at once, each independent, so you can pick one or copy the whole list.
- Strength and entropy
- Entropy is length × log2(alphabet size), in bits. Below 40 bits is weak, 60 is reasonable for online accounts, and 80 or more resists offline cracking for the foreseeable future.
How length and character sets add up
| Length | Entropy | Verdict |
|---|---|---|
| 8 characters | ≈ 52 bits | Fair — fine behind rate limits only |
| 12 characters | ≈ 78 bits | Strong for most accounts |
| 16 characters | ≈ 104 bits | Very strong |
| 24 characters | ≈ 155 bits | Far beyond any brute-force attack |
Limits and what to expect
- Entropy figures assume the password stays random; editing it by hand makes it weaker.
- Passwords are not saved. Reloading the page or changing a setting replaces them with new ones.
- Some sites reject certain symbols; if a password is refused, switch symbols off and generate again.
- A strong password does not protect against phishing — use two-factor authentication as well.
Troubleshooting
- A website says my password is invalid
- The site probably bans some symbols or caps the length. Switch symbols off or lower the length until it is accepted. A long password without symbols is still very strong.
- I keep misreading characters when typing it
- Turn on Exclude look-alike characters. The output then avoids pairs such as O and 0 or l and 1, which is ideal for passwords you have to read from paper.
- The strength says Weak
- Increase the length first: going from 8 to 14 characters matters far more than adding another character set. Watch the entropy readout rise as you drag the slider.
Your files and your privacy
Passwords are generated inside your browser tab from its own secure random source. They are never transmitted, logged or stored anywhere — not even in your browser's history — and the page works the same with your network disconnected.
What to use next
FAQ
Is this password generator really random?
Yes. It uses crypto.getRandomValues, the browser's cryptographically secure generator, with rejection sampling so every character is equally likely. It does not use Math.random, which is not suitable for secrets.
Are my passwords sent to your server?
No. They are created entirely in your browser and never leave your device. Nothing is logged or saved.
How long should my password be?
At least 12 characters for everyday accounts, and 16 or more for email, banking and your password manager's master password. If a password manager fills it in for you, 20 or more costs nothing.
Are symbols necessary?
They help, but length helps more. A 16-character password of letters and numbers is stronger than a 10-character one with symbols.
What does entropy in bits mean?
It is the number of yes/no guesses needed to cover every possible password, as a power of two. Each extra bit doubles the work for an attacker; 80 bits is about a trillion trillion possibilities.