Strong Password Generator
Random passwords generated in your browser. Choose the length and character types, see the entropy, and copy in one click.
Options
Length matters far more than which symbols you use. 16 or more is a sensible floor for anything valuable.
Drawing from 89 characters (lowercase, uppercase, numbers, symbols).
Runs entirely in your browser. Your file never leaves your device — nothing is uploaded to us.
Generate a Strong Password
Set the length and which characters to include, and a new password is generated instantly. Every password contains at least one character from each type you enable, so ticking 'symbols' always actually gives you a symbol.
Randomness comes from your browser's cryptographic random number generator, and the password never leaves the page — it is not sent to us, not logged and not stored.
Length Beats Complexity
The strength of a random password is its length multiplied by how many characters it draws from. Adding four characters to a password does far more than swapping an 'a' for an '@'.
A 12-character password from the full 90-character set is around 78 bits of entropy. Going to 20 characters takes it past 129 bits — beyond brute force for any foreseeable hardware. The entropy figure shown updates live so you can see the trade-off.
The rules that force one capital, one number and one symbol exist because human-chosen passwords are predictable, not because those characters are magic. A long random password is stronger than a short one with punctuation sprinkled in.
What Entropy Means Here
Entropy measures how many guesses an attacker needs on average, expressed in bits. Each extra bit doubles that number. It is only a valid measure because these passwords are genuinely random.
The same calculation applied to a password you invented yourself would be badly wrong: 'Summer2024!' looks complex but sits near the top of every cracking dictionary. That is why this tool measures what it generates and does not offer to score passwords you type in.
Using Generated Passwords Safely
A unique random password per account is only practical with a password manager. Generate the password here, paste it straight into the manager, and never retype it.
The look-alike option removes characters like l, I, 1, O and 0. It is worth enabling when a password has to be read aloud, dictated over the phone or typed from a printed sheet, and worth leaving off otherwise since it slightly shrinks the alphabet.
Frequently Asked Questions
Are the passwords sent to a server?+
No. They are generated in your browser and never transmitted, logged or stored. Closing the tab discards them.
How random are they?+
They use crypto.getRandomValues, the browser's cryptographically secure random source, not Math.random. Character selection uses rejection sampling so no character is more likely than another.
How long should my password be?+
At least 16 characters for anything valuable, and longer where the site allows it. Length contributes far more to strength than which symbols you include.
What does the entropy number mean?+
It is the number of bits of randomness in the password. Each additional bit doubles the guesses an attacker needs. Above roughly 80 bits a password is beyond practical brute force.
Should I exclude look-alike characters?+
Only when the password will be read aloud or typed by hand. It removes easily confused characters like l, I, 1, O and 0, which very slightly reduces the number of possible passwords.
Related Free Tools
These tools work great with your workflow too.