Strong Random Password Generator
Generate strong random passwords in your browser with crypto.getRandomValues. Choose length and character sets and see the exact entropy in bits.
Each password is drawn uniformly at random with crypto.getRandomValues from a pool of 89 characters. With 16 characters and the selected rules there are 2^103.4 possible passwords, i.e. 103.4 bits of entropy.
What is Password Generator?
This tool creates a random password from the character sets you select: uppercase, lowercase, digits and symbols. Every character comes from the browser's cryptographically secure random number generator, and the page shows how many bits of entropy the password really has.
How to use Password Generator
- Set the Length with the slider or type a number (4–128).
- Tick the character sets to use and, if you like, Exclude look-alike characters.
- Keep At least one character from each selected set on if a site demands it.
- Click Regenerate for a new password and Copy to put it on the clipboard.
Example
Length 16, uppercase + lowercase + digits + symbols, one of each set
un1f?zGz#~v4Sr2n (103.4 bits)
Output is random; you will get a different password each time. The entropy value is exact for these settings.
When to use Password Generator
Use it whenever you need a new password for an account, Wi-Fi network, database user or API credential that will be stored in a password manager. If you must type or remember the password, a diceware passphrase is easier to handle with similar strength. Do not use it to check an existing password; use the strength checker for that.
How Password Generator works
The pool is the union of the selected sets (26 uppercase, 26 lowercase, 10 digits, 27 symbols !@#$%^&*()-_=+[]{};:,.<>/?~). Each character is drawn with crypto.getRandomValues using rejection sampling, so every character in the pool is exactly equally likely (no modulo bias). When every set is required, the whole password is redrawn until it contains each set, which keeps the result uniform over all valid passwords. The entropy shown is log2 of the exact number of possible passwords, computed with inclusion–exclusion over the required sets.
Common Use Cases
- Creating a unique password for each website, stored in a password manager
- Setting a strong Wi-Fi (WPA2/WPA3) passphrase
- Generating initial passwords for database or service accounts
- Replacing a password that appeared in a data breach
Security Note
Store generated passwords in a password manager and never reuse one across sites. Clipboard contents can be read by other apps, so clear it after pasting on shared computers.
FAQs
How long should a password be?
With all four sets, 16 characters give about 103 bits, far beyond what any offline attack can brute-force. NIST SP 800-63B-4 asks for at least 15 characters for passwords used on their own.
Is the password sent to a server?
No. It is generated by JavaScript in your browser and never leaves the page unless you copy it somewhere.
Why does requiring every set lower the entropy slightly?
Requiring at least one character of each set removes the passwords that lack a set, so there are a few fewer possibilities. The page computes the exact number instead of the usual length × log2(pool) approximation.
What does excluding look-alike characters do?
It removes 0, O, 1, l, I and | from the pool so the password is easier to read and type by hand, at a small cost in entropy that the displayed value already includes.