Strong Password Generator – Random & Secure

How the Password Generator works

Every character or word is chosen with crypto.getRandomValues, the secure random number generator built into your browser. Random bytes are turned into choices with rejection sampling: values that would make some characters slightly more likely than others are thrown away and drawn again, so every character in the pool has exactly the same chance. When At least one of each chosen set is ticked, the generator first picks one character from each set, fills the rest from the whole pool, and then shuffles the result with a Fisher–Yates shuffle so the guaranteed characters can land anywhere.

Passphrase mode picks words from a built-in list of 1,172 short, common English words. The strength shown under the results is calculated from the settings, not guessed from the text: it is the base-2 logarithm of how many different results the generator could have produced. For example, 16 characters from all four sets (90 characters) give about 103 bits, and five words from the list give about 51 bits. The tool is read-only: passwords are not saved, logged or sent anywhere, and they disappear when you close or reload the page.

How to use the Password Generator

Choose Random password or Passphrase (words), and how many to generate (1 to 100).
For a password, set the length (4 to 128) and tick the character sets to use: lowercase, uppercase, digits and symbols. Tick Exclude look-alikes to leave out characters such as I, l, 1, O and 0.
For a passphrase, choose the number of words, the separator, and whether to capitalize words and add a digit.
Select Generate passwords, or press Ctrl + Enter (Cmd + Enter on a Mac). Check the strength and entropy shown under the list.
Select Copy and paste the password into your password manager or sign-up form.

Example

With Length 16 and all four character sets ticked, one run produced:

Q_:0a{7,yH7v!+ga
VE#c<|V7ON1a|J0%

Strength: Strong, ≈ 103 bits, chosen from 90 characters.

In passphrase mode with 5 words, hyphens, Capitalize words and Add a digit:

Tornado-Fish7-Net-Funny-Falcon

Strength: Reasonable, ≈ 56 bits, chosen from 1,172 words. Add words to make a passphrase stronger.

Common use cases

Creating a unique password for a new account and saving it in a password manager.
Generating a passphrase that is easier to type, such as a Wi-Fi password or a computer login.
Creating temporary passwords, API secrets or database passwords for development and test environments.
Producing passwords that meet a policy requiring uppercase letters, digits and symbols.

Common errors and how to fix them

Choose at least one character set: Every set is unticked, so there are no characters to draw from. Tick at least one of lowercase, uppercase, digits or symbols.
Length must be a whole number between 4 and 128: The length box is empty, fractional or out of range. Sixteen characters or more is a sensible minimum for an account password.
A website rejects the generated password: Many sites quietly ban particular symbols or cap the length. Untick symbols or reduce the length to fit their rules, and compensate by making the password longer rather than more exotic.
This browser does not provide a secure random number generator: The tool refuses to fall back to a weaker source of randomness. Update your browser, or load the page over HTTPS, because the Web Crypto API is unavailable on insecure origins in some browsers.

Frequently asked questions

Are the passwords generated securely?

Yes. Every character or word is chosen with crypto.getRandomValues, the browser's cryptographically secure random generator, using rejection sampling so that every character in the pool is equally likely. Math.random is not used.

Are my passwords stored or sent anywhere?

No. They are generated in your browser, are not sent to our server and are not saved. They are gone when you reload or close the page, so copy the one you want to keep.

How is the strength calculated?

The entropy is the base-2 logarithm of the number of different results your settings can produce: for passwords, the number of strings of that length over the chosen characters that contain every required set; for passphrases, the number of possible word sequences plus the added digit. Under 36 bits is weak, 60 bits or more is strong, and 128 bits or more is very strong.

What does At least one of each chosen set do?

It guarantees that the password contains at least one character from every set you ticked. One character is picked from each set, the rest are picked from all the chosen characters, and then the characters are shuffled, so the required characters can appear in any position.

Which symbols are used?

The symbol set is ! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . < > / ? ~ and |. Quotes, backslashes and backticks are left out because they often cause problems in command lines and configuration files. Exclude look-alikes also removes the | character.

Is a passphrase as secure as a random password?

It can be. Each word from the 1,172-word list adds about 10.2 bits, so six words give about 61 bits, similar to a 10-character password using all four character sets. Add words to make a passphrase stronger.