Password Generator
Generate strong random passwords in your browser using the Web Crypto API, with an entropy rating. Nothing is transmitted.
Create strong random passwords in your browser. Nothing is sent anywhere.
Strength
Strong
126 bits of entropy from a 79-character set.
Generating...What the password generator does
Password strength is measured in entropy bits, which is length multiplied by the log of the character set size. Length beats complexity: a twenty character lowercase password is stronger than a ten character one with every symbol type.
Randomness comes from crypto.getRandomValues, not Math.random, which is not suitable for anything security related. Generation happens entirely in your browser.
The honest use for a generator like this is a password you will never type: one you create, copy, and hand straight to a password manager. For the few you do type, a passphrase of several unrelated words is often both stronger and easier to live with, which is why length is the dial that matters most here.
Good to know
- The entropy figure assumes an attacker who knows your exact settings and is guessing at random. It is a floor, not a promise, and it says nothing about a password you then reuse or write on a sticky note.
- Lookalike filtering slightly lowers entropy by shrinking the alphabet. The trade is worth it only when a human will read or type the password; for a manager-stored secret, leave it off.
- Nothing is remembered between batches. Regenerating does not store the old passwords anywhere, so copy the one you want before moving on.
Using the tool
- 1Set the length. Sixteen is a reasonable floor, twenty or more is better.
- 2Choose which character sets to include.
- 3Turn on lookalike filtering if the password will be typed by hand or read aloud.
- 4Read the entropy rating.
- 5Change the Regenerate number for a fresh batch.
Common questions
Are these passwords sent anywhere?
No. They are generated in your browser with the Web Crypto API and never leave the page. Nothing is logged.
How long should a password be?
At least sixteen characters for anything that matters. Length contributes more to entropy than adding symbol types does.
What is the lookalike filter?
It removes characters that are easily confused, such as O and 0 or l and 1. Useful when the password will be typed manually or dictated.
What does the entropy rating actually mean?
It estimates how many guesses an attacker would need. Each extra bit doubles that number, so going from 60 to 80 bits is not a third harder, it is about a million times harder.
Should every site get a different password?
Yes. Reuse is the single biggest real-world risk, because one leaked site then unlocks the others. A generator plus a manager is what makes unique passwords everywhere practical.