Generators

Password Generator

Generate strong random passwords or memorable passphrases with adjustable length, character sets and an entropy estimate, computed only in your browser.

Random password generator

Generating…

Drops l 1 I O 0 — useful for a password you'll type by hand or read aloud, since those are the characters people misread most often in an unfamiliar font.

Password strength meter

Entropy

103.4 bits

Rating

Strong

Time to crack

20 trillion years

Assumes an offline attacker guessing at 10,000,000,000 guesses a second (roughly what a single high-end GPU manages against a fast, unsalted hash) and averages trying half of every possible combination — a password stored behind a slow, salted hash (bcrypt, scrypt, Argon2) would take far longer than this to crack, never less.

Pick a mode above — a random character password or a passphrase built from whole words — adjust the length and the character classes or word count, and copy the result with the Copy button. Every value shown is generated fresh in your own browser using the same cryptographically secure randomness browsers use for encryption keys, and nothing about it is ever sent anywhere; see "Does this tool ever send my password anywhere?" below for exactly what that covers.

How long should a password be?

There's no single right answer, because the right length depends on what's generating it and what the account will let you use. For a password this tool generates, 16 characters across all four character classes is a strong, comfortable default that works almost everywhere — it lands around 100 bits of entropy, which the Password strength meter panel shows directly rather than asking you to trust a label. Twelve characters is a reasonable practical floor for an account that matters; shorter than that, entropy runs out quickly even with every character class turned on, because entropy is length × log2(alphabet size) and length is doing most of the work in that formula. Some sites still cap password length in ways that fight this advice — if a site refuses anything over, say, 20 characters, that is a real limitation on how strong a password you can use there, and it's worth treating as a mark against that site's own security practices rather than something to work around.

Choosing character classes and excluding look-alike characters

The four toggles — uppercase, lowercase, numbers and symbols — each add a distinct alphabet the generator draws from, and turning more of them on increases the alphabet size that goes into the entropy calculation. This tool guarantees that a generated password contains at least one character from every class you've selected, so turning on "Symbols" means the result genuinely has a symbol in it rather than a generator that technically allows symbols but rarely produces one. The "Exclude look-alike characters" toggle drops lowercase L, uppercase I, the digit one, uppercase O and the digit zero from every class — useful specifically for a password you expect to type by hand from a printed slip or read aloud over the phone, since those five are the characters people misread most often in an unfamiliar font. Leave it off for a password you'll only ever paste from a password manager, since it slightly narrows the character set for no benefit in that case.

The Passphrase generator mode strings together several words from a bundled 512-word list rather than random characters — five words by default, adjustable from three up to twelve. Each word contributes exactly 9 bits of entropy (log2(512)), shown alongside the passphrase so the math is never hidden behind a strength label. This is the format increasingly recommended for anything a person has to type from memory rather than paste from a manager, because a handful of ordinary words is both easier to recall accurately and, at a comparable length, no weaker than a shorter run of random characters. The optional capitalization and trailing digit are cosmetic — deliberately not counted toward the entropy figure shown, since both are predictable transformations rather than an extra random choice, so the number displayed never overstates what the passphrase actually resists.

Password strength meter: reading the entropy and crack-time figures

The strength panel under each generated value shows three things together, on purpose: the exact entropy in bits, a plain-language rating from "Very weak" to "Very strong", and an estimated time to crack. That last figure always comes with its assumption stated in the line underneath it — a named guess rate against an offline attack on a fast, unsalted hash — because a crack-time estimate with no stated assumption is a number nobody can check. The assumption is deliberately generous to the attacker: a password actually protected by a slow, salted hashing algorithm would take far longer to crack than the figure shown, never less, so treat the estimate as a floor on how long a password would survive, not a promise.

Questions

How long should a password be?
For a random password generated by a tool like this one, 16 characters using all four character classes (uppercase, lowercase, numbers and symbols) is a comfortable, currently-safe default — it works out to roughly 100 bits of entropy, well past the point where brute-force guessing is a realistic threat even against a fast offline attack. Twelve characters is the practical floor for an account you actually care about; below that, even a full character set runs out of entropy fast once an attacker has offline access to a stolen password hash. If the account supports a passkey or hardware security key instead of a password, that beats any password length, because there is no password for an attacker to guess in the first place. For a passphrase, five to six words from this tool's wordlist lands in a similar range (45-54 bits) and is far easier to type and remember than a random character string of comparable strength.
Are password generators safe to use?
A password generator is exactly as safe as the arithmetic and randomness behind it, and both are things you can check rather than take on faith. This one uses the Web Crypto API's `crypto.getRandomValues()` — the same cryptographically secure random number source browsers use for TLS keys — rather than `Math.random()`, which is not designed to be unpredictable and should never generate a secret. The bigger risk with an online password generator in general is a server-side one you cannot inspect: if a tool generates your password on a server and sends it to your browser, that server saw the password in transit, whether or not it claims to log it. This tool never makes that trade — see "Does this tool ever send my password anywhere?" below for exactly what that promise covers and how it's enforced, not just stated.
Is this password strong enough?
Look at the Password strength meter panel under the generated value: it shows the exact entropy in bits, a plain-language rating, and an estimated time to crack against a stated, named assumption about the attacker — not a bare "Strong!" badge with nothing behind it. As a rule of thumb, under 28 bits is weak enough to fall to an offline attack in minutes, 60+ bits is currently outside any realistic brute-force budget, and 128+ matches the key length of a modern symmetric cipher. The honest caveat, stated in the panel itself: the crack-time estimate assumes a specific guess rate against a fast, unsalted hash, which is a conservative (attacker-favorable) assumption — if the service storing your password uses a slow, salted hashing algorithm like bcrypt, scrypt or Argon2, the real time to crack is far longer than the figure shown, never shorter. No password strength meter, including this one, can know how a specific website stores your password, so it can only tell you how hard the password itself is to guess, not how well the site protects it.
What is a passphrase, and is it better than a password?
A passphrase strings together several random, unrelated words — this tool's default is five — rather than a shorter string of random characters. Current guidance from security researchers and standards bodies (including NIST) increasingly recommends passphrases specifically for anything a human has to type from memory, because a sequence of ordinary words is dramatically easier to recall and to type accurately than a random jumble of symbols, while still carrying real entropy: each word drawn from this tool's 512-word list contributes exactly 9 bits, so a 6-word passphrase (54 bits) is comparable in strength to an 8-9 character fully-random password and easier to remember than either. A passphrase is not automatically stronger than a password of any length — a 20-character random password beats a 4-word passphrase — the real comparison is always the entropy figure shown for each, not the category of password.
Does this tool ever send my password anywhere?
No, and not only as a policy this page states: the generator's code runs entirely inside your browser, and every tool on this site is built under a rule enforced at the code level, not merely promised in writing, that a tool's interactive widget contains no network request of any kind — no `fetch`, no `XMLHttpRequest`, no beacon, nothing. That rule is checked automatically before any change to this tool can ship, so it isn't a claim you have to trust after the fact. The password never exists outside your own device's memory, and it is never written to this browser's storage either — closing the tab or refreshing the page clears it completely, the same as if you'd typed it into a blank text box with no code running behind it at all.
Why does the password disappear if I refresh the page?
Because it was never saved anywhere to begin with — refreshing clears the same in-memory value a page reload would clear for any unsaved form field. This is deliberate rather than a missing feature: a saved history of previously generated passwords would be a second copy of a secret sitting in this browser's storage indefinitely, on a device that might be shared, which is precisely the kind of risk a password generator exists to avoid creating. If you need to keep a generated password, copy it into a password manager immediately after generating it — that is the tool actually designed to store secrets safely, with encryption this page has no way to offer.