Password Generator
Create strong random passwords right in your browser with adjustable length and character sets.
How the generator works
When you set a length and choose which character sets to include, the tool builds a pool of allowed characters and then draws from it using the browser's cryptographic random number generator (crypto.getRandomValues), not the predictable Math.random. To avoid modulo bias, which would make some characters slightly more likely than others, each pick is taken from an unbiased range so every character in the pool has exactly the same chance. The generator also guarantees at least one character from each set you enabled, so a password you asked to include symbols will never come back without one. Everything happens locally on your device; the result exists only in your browser tab.
What password strength actually means
Password strength is usually measured in bits of entropy, which describes how many guesses an attacker would need on average. The formula is length multiplied by the base-2 logarithm of the pool size. A 12-character password using lowercase, uppercase, digits, and symbols draws from a pool of 85 characters (26 lowercase, 26 uppercase, 10 digits, and this tool's 23 symbols), giving roughly 6.4 bits per character, or about 77 bits total. Each extra character adds the same 6.4 bits, which is why length matters more than squeezing in one more symbol type. As a rough guide, under 40 bits is weak, 60 to 80 bits is reasonable for everyday accounts, and 100 bits or more is appropriate for anything protecting money, identity, or other people's data.
A worked example
Suppose you generate a 16-character password from all four sets: pool size 85, entropy about 16 times 6.4, or roughly 102 bits. That means around 2 to the power of 102 possible combinations. Even an attacker able to try a trillion guesses per second offline would need far longer than the age of the universe to exhaust that space. Now compare a 16-character password limited to lowercase only: pool 26, about 4.7 bits per character, or roughly 75 bits total. Both are 16 characters long, but the all-sets version is about 2 to the power of 27 times harder to crack, which is why turning on more character types is worth doing when a site allows it.
When and how to use it
- New accounts: generate a unique password for every site so a breach at one service can never unlock another.
- Password rotation: if you suspect a login was exposed in a leak, reissue a fresh password immediately rather than tweaking the old one.
- Non-login secrets: create random strings for Wi-Fi passphrases, database seeds, API-key candidates, or one-time tokens where you just need unpredictable characters.
- Meeting strict rules: adjust the sets and length to satisfy sites that demand, for example, at least one symbol and one number within a fixed length.
Common mistakes and misconceptions
- Making it too short to look clever: swapping letters for symbols in a common word (P@ssw0rd) adds almost no real strength because attackers know those substitutions.
- Reusing one strong password everywhere: a single leak then compromises every account. Uniqueness matters as much as strength.
- Assuming forced complexity equals safety: a random 20-character all-lowercase phrase can beat a short mixed-set password. Length is the biggest lever.
- Storing the result in a chat, sticky note, or plain text file where anyone with access can read it.
- Regenerating endlessly hoping for a 'nicer' password. Every valid output at the same settings is equally strong; readability preferences do not change the math.
Cautions and limits
A strong password only protects the account it belongs to, and only until it is entered somewhere insecure. Phishing pages, keyloggers, and reused passwords defeat even a perfect random string, so pair generated passwords with two-factor authentication wherever it is offered. This tool does not store, sync, or remember anything: once you reload or close the tab, the password is gone. That is good for privacy but means you must save it somewhere safe, ideally a reputable password manager, before you navigate away. The tool also cannot judge whether a specific site's rules are met beyond the sets and length you selected, so double-check any unusual requirements a service lists.
Passwords are generated with your browser's cryptographic random generator (Web Crypto) and are never sent to or stored on a server. Nothing is recorded, so use them safely.
Read the Privacy Policy →Frequently asked questions
Are generated passwords sent to a server?
No. Passwords are created entirely in your browser using the Web Crypto API and are never transmitted, logged, or stored on any server. Nothing leaves your device, and the value disappears when you reload or close the tab.
How long should a password be?
Twelve characters with mixed sets is a sensible minimum for everyday accounts, giving roughly 77 bits of entropy. For email, banking, or anything protecting money or identity, use 16 or more characters, which pushes you past 100 bits and well beyond any realistic brute-force attack.
Is it truly random?
It uses the browser's cryptographic random generator (crypto.getRandomValues), which is designed to be unpredictable, rather than Math.random, which is not safe for secrets. The tool also corrects for modulo bias so every character in the pool is equally likely, with no hidden pattern.
Should I include symbols, or are letters and numbers enough?
Enable every character set the site allows, because a larger pool means more entropy per character. That said, adding length is the most powerful single change: a longer password with fewer set types can easily beat a short one packed with symbols.
How do I remember a random password like this?
You generally should not try to memorize per-site random passwords. Use a reputable password manager to store them, so you only remember one strong master password, and reserve memorization for that master and perhaps a couple of critical logins.
Can I use this for API keys, Wi-Fi passwords, or other secrets?
Yes. Any place that needs an unpredictable string, such as a Wi-Fi passphrase, a seed value, or a one-time token, is a fair use. Just confirm the target system's allowed length and character set first, since some devices reject certain symbols.