Password Generator
Create strong random passwords in your browser.
Runs entirely in your browser. Nothing is sent to a server.
Save this tool
Keep Password Generator handy
Use your browser's Share menu, then “Add to Home Screen”.
About this tool
A strong password is simply a long one drawn from a large pool of characters at random, and the hard part is that people are bad at being random. This generator uses your browser's cryptographic random number source, the same primitive used to secure network connections, rather than the weaker generator behind most scripting shortcuts. It also samples characters without the modulo bias that quietly makes many generators favour the start of the alphabet. You can set the length, choose which character types to include, and exclude lookalikes such as I, l, 1, O and 0 when the password will be read aloud or typed by hand. The entropy figure shown underneath tells you how much genuine randomness you are getting, measured in bits, which is a far better guide than a coloured strength bar. Passwords are generated locally and never transmitted, logged, or stored.
How to use it
- Choose a length and which character types to include
- Click Generate to get a new password
- Copy it straight into your password manager
Frequently asked questions
Are these passwords sent to your server?
No. They are generated entirely in your browser using the Web Crypto API, so nothing is transmitted over the network and nothing is stored. You can disconnect from the internet after the page loads and it keeps working.
How long should my password be?
For anything that matters, aim for at least 16 characters with mixed types, which puts you comfortably above 90 bits of entropy. Length helps far more than complexity rules do, so a longer password from a smaller alphabet usually beats a short one full of symbols.
What does the entropy figure mean?
It is the number of bits of randomness in the password, calculated from its length and the size of the character pool. Each additional bit doubles the effort needed to guess it. Below about 45 bits is weak, and above 90 bits is very strong against offline attacks.
Why would I exclude ambiguous characters?
Because capital I, lowercase l and the digit 1 look nearly identical in many fonts, as do capital O and zero. If a password will be printed, read aloud, or typed manually, removing them prevents frustrating mistakes. It slightly reduces entropy, so add a character or two to compensate.
Should I reuse a generated password?
No. Use a unique password for every account and store them in a password manager. Reuse is what turns a single breach at one site into compromised accounts everywhere else.