Password Generator
Generate a strong random password with your choice of length and character types. Passwords come from your browser’s cryptographically secure random generator and are never sent or stored.
How this password generator works
Each character is picked independently and uniformly from the characters you allow, using crypto.getRandomValues, the browser’s cryptographically secure random number generator. The page uses rejection sampling to turn random 32-bit numbers into positions in the character pool, so no character is more likely than another. It does not use Math.random(), which is not designed to be unpredictable.
The password is created in your browser and shown only on this page. It is not sent to a server, saved in a cookie or written to storage.
How to use it
- Drag the Length slider to choose 6 to 64 characters. The default is 16.
- Tick the character types to include: A-Z, a-z, 0-9 and !@#$%.
- Tick Exclude ambiguous (l1IO0) if the password will be read or typed by a person.
- A new password appears whenever you change a setting. Click Generate for another with the same settings, and Copy to put it on the clipboard.
Options explained
- A-Z and a-z add 26 letters each, and 0-9 adds 10 digits.
- !@#$% adds 18 symbols, not just the five on the label:
! @ # $ % ^ & * ( ) - _ = + [ ] { }. Quotes, backslashes, spaces and angle brackets are never used, so the result is easier to paste into configuration files and shell commands. - Exclude ambiguous (l1IO0) removes lowercase
l, the digit1, capitalI, capitalOand the digit0. - Every ticked type appears at least once. If a candidate is missing one, the tool discards it and draws again, so a password will not fail a “must contain a digit” rule.
- If you untick every type, the tool shows
Select at least one character type.and no password.
The entropy figure
“Estimated entropy” is length × log2(pool size), rounded to whole bits. All four types give a pool of 80 characters, worth about 6.32 bits each, so 16 characters show 101 bits: 2101 equally likely passwords. Each extra bit doubles the number of guesses an attacker needs in the worst case.
| Character types | Pool | 12 chars | 16 chars | 20 chars |
|---|---|---|---|---|
| All four | 80 | 76 bits | 101 bits | 126 bits |
| All four, ambiguous excluded | 75 | 75 bits | 100 bits | 125 bits |
| Letters and digits | 62 | 71 bits | 95 bits | 119 bits |
| Lowercase and digits | 36 | 62 bits | 83 bits | 103 bits |
| Digits only | 10 | 40 bits | 53 bits | 66 bits |
Two honest caveats. First, the “at least one of each type” rule rules out some combinations, so the true figure is slightly lower than shown: about 1.8 bits less at 6 characters with all four types, 0.2 bits less at 16. Second, the figure only applies to passwords produced at random like this; it says nothing about a password a person invented. Length adds entropy faster than extra character types: 20 letters and digits (119 bits) beat 16 characters from the full set (101 bits).
What current guidance says
NIST’s SP 800-63B (revision 4, 2025) tells services how to handle passwords. Among its requirements: a minimum of 15 characters when a password is the only factor, and 8 when it is part of multi-factor authentication; allowing at least 64 characters; no composition rules such as “must include a symbol”; no forced periodic changes; and checking new passwords against lists of compromised ones. The tool’s 64-character maximum matches that upper figure.
Which settings to use
| Situation | Suggested settings |
|---|---|
| Website login stored in a password manager | All four types, 20 characters or more |
| Password you must read out or type from paper | Exclude ambiguous, and add length instead of symbols |
| System that rejects some symbols | Untick !@#$% and raise the length by 2 to 4 characters |
| Wi-Fi (WPA2-Personal) passphrase | Any types, 8 to 63 characters, the range WPA2 allows for a passphrase |
| Database or service account secret | Letters and digits only, 32 characters or more, to avoid escaping problems in connection strings |
Frequently asked questions
Is it safe to generate a password in a web page?
With this page, the randomness comes from the same secure generator the browser uses for its own cryptography, and the result never leaves your device. The weak points are elsewhere: clipboard history, screenshots, and browser extensions that can read pages. Save the password in a password manager straight away and clear it from the clipboard if your system keeps a history.
Why does the password change when I move the slider?
Every change to length or character types generates a fresh password, so what you see always matches the settings and the entropy shown. Set everything first, then copy.
Why does excluding ambiguous characters lower the entropy?
It shrinks the pool from 80 to 75 characters, so each character carries about 6.23 bits instead of 6.32. At 16 characters the difference is about 1.5 bits (the display shows 100 instead of 101), and one extra character more than recovers it.
Should I change my passwords every few months?
Not on a schedule. NIST SP 800-63B says services should not force periodic changes, because people respond with predictable variations. Change a password when there is a sign it has been exposed, such as a breach notice.
Can it make passphrases from words?
No, it only generates characters. A passphrase of six words chosen at random from a 7,776-word list (the Diceware method) has about 77.5 bits of entropy, comparable to 12 characters from this tool’s full set, and is easier to type.
How should a service store the password?
Never in plain text and never as a fast hash such as SHA-256. Use a password-hashing function designed to be slow and salted, such as Argon2id, scrypt or bcrypt. The Hash Generator page explains where fast hashes do belong.