How to use the password generator
- Set the length — 16 characters or more is a good default for accounts.
- Choose which character types to include, and optionally exclude look-alike characters.
- A new password appears instantly; press “Generate” for another.
- Copy it straight into your password manager.
How it works
Random numbers come from crypto.getRandomValues, the browser's cryptographically secure generator. To pick a character from a pool of n characters, a naïve random % n would slightly favour some characters. Instead the tool uses rejection sampling: it discards any 32-bit random value at or above the largest multiple of n and draws again, so every character is exactly equally likely.
When “at least one of each type” is on, a whole password is redrawn until it contains every selected type, which keeps all valid passwords equally likely. Entropy is then log₂ of the number of possible passwords, counted exactly with the inclusion–exclusion principle. Read more in our guide to choosing a strong password.
Worked example
A 20-character password drawn from all 94 printable ASCII characters has 20 × log₂ 94 ≈ 131.1 bits of entropy. Requiring at least one lowercase letter, capital, digit and symbol trims that only slightly, to about 130.9 bits. A 10-digit PIN, by comparison, has only 33.2 bits.
Limitations
- Entropy assumes the attacker knows your settings; it measures the generator, not a password you edit by hand.
- Some websites reject certain symbols or cap the length; adjust the options to fit their rules.
- Crack-time figures assume 10 billion guesses per second offline and are rough illustrations only.
- Generated passwords are not stored; copy them before leaving the page.
Frequently asked questions
Are these passwords truly random?
They use the operating system's cryptographically secure random source via the Web Crypto API, the same source browsers use for encryption keys.
How long should my password be?
For accounts protected by a password manager, 16–20 random characters is plenty. For a master password you must type, consider a long passphrase of several random words.
What does entropy in bits mean?
Each extra bit doubles the number of guesses an attacker needs. 80 bits means about 2⁸⁰ possibilities, far beyond any practical brute-force attack.
Do you see or store the passwords?
No. They are generated in your browser and never sent over the network or saved by this site.
Why exclude ambiguous characters?
Characters like l, 1, I, O and 0 look alike in many fonts. Excluding them helps if you need to read a password aloud or type it from paper, at a small cost in entropy.