Generate strong passwords in your browser using its cryptographic random source. Choose the length and character sets, exclude look-alike characters, and require at least one character from every set. The strength is reported in bits of entropy rather than a vague "strong" badge, and nothing generated here is transmitted or stored.
Settings
Recent results
Generated locally in your browser — your settings and results never leave this page.
What makes a password hard to guess
Two things decide how hard a password is to attack: how many characters it has, and how many different characters each position could have been. Multiply those together in the right way and you get the size of the search space an attacker has to work through. The tool reports that size in bits, because bits are the only unit that lets you compare a short complicated password with a long simple one.
The arithmetic is straightforward. An alphabet of 94 printable characters gives about 6.55 bits per character, so a 16-character password carries roughly 105 bits. Lowercase letters alone give 4.7 bits per character, so reaching the same strength needs about 23 characters. Neither is better in the abstract — the second is longer but far easier to type, and on a phone keyboard that difference is worth having.
Length beats complexity
Every character you add multiplies the search space by the size of the alphabet. Every extra character class you add only widens the alphabet a little. Going from 12 to 16 characters with letters and digits multiplies the work by nearly fifteen million. Adding symbols to a 12-character password multiplies it by about eighteen. Both help; only one of them helps dramatically.
This is why composition rules have fallen out of favour with security guidance. Demanding an uppercase letter, a digit and a symbol tends to produce predictable results — a capital at the start, a digit and an exclamation mark at the end — because that is what people reach for when a form rejects their first attempt. A generated password has no such habits, which is the main reason to use one.
Where a generated password should live
A password you cannot remember is only useful if something remembers it for you. In practice that means a password manager. Generate the password, paste it in, and never type it again. The one password you do need to remember is the one that unlocks the manager, and that is a good place for a long passphrase rather than a short complicated string.
If you are choosing a password that must be typed by hand — a device PIN, a Wi-Fi key read off a card, a shared login for a machine in a workshop — the trade-offs change. Turn symbols off, exclude the look-alike characters, and add length to make up the difference. A 20-character alphanumeric key is easy to read aloud and still far beyond guessing.
What the strength note does and does not tell you
The note under each password describes the generator, not the individual value. Any password that a fair 105-bit process can produce is exactly as likely as any other, including one that happens to spell a word. Strength meters that score the characters you can see are guessing at something they cannot know: whether the value came from a large uniform draw or from a person picking a memorable pattern.
That distinction matters when a site rejects a generated password as “weak” because it lacks variety. The site is scoring the appearance of the string. The figure here describes the process that produced it, which is the thing an attacker actually has to defeat.
Reusing passwords is the real risk
Most accounts are not lost to brute force. They are lost because a password used in one place was exposed somewhere else and then tried everywhere. A unique password per account contains that damage to a single site. This is the single biggest reason to generate rather than invent: nobody can remember a different strong password for every account, and nobody needs to.
Privacy
Everything happens in this page. Generated passwords are never sent to a server, never written to storage, never recorded in analytics and never placed in the URL — the tool deliberately has no share link for exactly that reason. Close the tab and the values are gone.
How to use the Secure Password Generator
- Choose a length. Twelve characters is the practical floor; 16 or more is better wherever the site allows it.
- Select the character sets you need. Some sites reject certain symbols, so you can turn symbols off without weakening the rest.
- Leave "require one character from every set" on if the site enforces composition rules.
- Press Generate, then copy the password straight into your password manager.
Frequently asked questions
How does this tool generate passwords?
Each character is drawn from your browser's cryptographic random source, crypto.getRandomValues, using rejection sampling so every character in the selected alphabet is equally likely. A naive approach that maps random numbers onto an alphabet with the remainder operator makes some characters slightly more common than others; rejection sampling discards the values that would cause that skew and draws again.
Is it safe to generate a password on a web page?
The generation happens entirely in your browser. No password is sent to a server, written to storage, recorded in analytics or included in the page URL, and reloading the page discards everything. That said, the safest place to create a password is usually your password manager, because it generates and stores the value in one step without it ever appearing on screen.
What does "bits of entropy" actually mean?
It is the number of yes/no questions an attacker would need to answer to pin down your password, assuming they know exactly how it was made. Each extra bit doubles the work. A 16-character password from a 94-character alphabet carries about 105 bits, which is far beyond what offline cracking can reach today. It is a measure of the process, not of any individual password: a strong generator can still produce "aaaaaaaa" occasionally, and that password is exactly as likely as any other.
Should I include symbols?
Include them when the site accepts them, because they widen the alphabet and add roughly 0.6 bits per character compared with letters and digits alone. Length matters more, though. A 20-character password without symbols is stronger than a 12-character password with them, and it is far easier to type on a phone.
Why is there an option to exclude look-alike characters?
Capital I, lowercase l, the digit 1, capital O, the digit 0 and lowercase o are easy to confuse in many fonts. If a password will ever be read aloud, printed, or typed from a screenshot, excluding them prevents support calls. It shrinks the alphabet slightly, so add a character or two of length to compensate.
Does requiring one character from every set make passwords weaker?
Very slightly, because it rules out the combinations that happen to omit a set. The reduction is small enough not to matter at normal lengths, and the tool tells you the figure shown is a close upper bound rather than an exact one. The rule exists because many sites reject passwords that lack a digit or a symbol, and a rejected password is worse than one that is a fraction of a bit weaker.
Can I generate several passwords at once?
Yes — raise the count and each password is generated independently. This is useful when you are setting up several accounts or seeding test fixtures. Copy or download them all at once from the result panel, and delete the file afterwards if the passwords are real.
