Ttooleras
🔑

Password Generator

Generators

Generate strong, cryptographically secure random passwords. Free, private — all processing in your browser.

4128
Advertisement

This generates strong, random passwords in your browser — pick a length, choose which character types to include, and get one or a batch at once, each with a live strength read and its entropy in bits. Presets cover the common cases (a 4-digit PIN, a quick 8-character login, a 16-character default, a 32-character maximum), or dial in your own.

The randomness comes from your browser's cryptographic random source, not Math.random(), and nothing is generated on or sent to a server — the password exists only on your screen until you copy it. There are also practical switches: exclude ambiguous characters (0/O, 1/l/I) for passwords you'll type by hand, or exclude specific characters a particular site rejects.

What the Password Generator can do

Cryptographically secure randomness

Uses Web Crypto API (crypto.getRandomValues), the same CSPRNG used by TLS. Not Math.random. Suitable for real cryptographic use.

Customizable length

Generate passwords from 8 to 128 characters. Longer is always stronger. We recommend 16+ for most accounts, 20+ for critical accounts.

Character class toggles

Include or exclude uppercase letters, lowercase letters, digits, and symbols. Every enabled class guarantees at least one character of that type in the output.

Exclude ambiguous characters

Remove visually similar characters (0/O, 1/l/I, {, }, ``, etc.) to avoid transcription errors when typing passwords manually or reading them from printed lists.

Passphrase mode

Generate human-memorable passphrases using Diceware-style word lists. 6 words ≈ 77 bits of entropy — strong and easy to remember.

Bulk generation

Generate up to 100 unique passwords at once. Useful for provisioning multiple service accounts, test fixtures, or one-time access credentials.

Real-time strength meter

See the estimated entropy (in bits) and crack time for every generated password. Know exactly how strong your password is.

Copy and download

Copy to clipboard with one click, or download bulk-generated passwords as a CSV or TXT file for secure storage in your password manager.

No tracking, no logging

Passwords are generated entirely in your browser. Nothing is transmitted, stored, or analyzed. Open the Network tab in DevTools to verify zero outbound requests.

How to use the Password Generator

  1. 1

    Choose password length

    Set the length slider. 12 characters minimum, 16+ recommended for most accounts, 20+ for high-value accounts (banking, email, crypto wallets).

  2. 2

    Select character classes

    Enable uppercase, lowercase, digits, and symbols. More classes means more entropy per character. For systems that reject symbols, disable them — but increase length to compensate.

  3. 3

    Exclude ambiguous characters if needed

    Enable this if you will ever need to read the password off a screen or printed page. Skips characters that look similar in common fonts.

  4. 4

    Click Generate

    A new password appears instantly. Click Generate again for a different one. The strength meter shows how resistant it is to brute force.

  5. 5

    Copy to your password manager

    Click Copy and paste into your password manager (1Password, Bitwarden, KeePass, etc.). Never memorize and reuse — let the manager store one unique password per account.

  6. 6

    For passphrases, switch to passphrase mode

    If the account allows long passwords and you need to type it occasionally, use passphrase mode. 6 words separated by hyphens is typical.

Where this helps

Personal and workplace accounts

  • Email accounts: Email is the master key to most other accounts (password reset). Use 20+ character passwords with all character classes.
  • Banking and finance: Banks, brokers, and crypto exchanges should have their own unique 20+ character password and two-factor authentication.
  • Social media: Compromised social accounts can be used for phishing your contacts. Use 16+ characters, unique per platform.
  • Work SaaS accounts: Slack, Notion, Jira, GitHub, Google Workspace — each needs a unique password. Use your company's SSO or password manager.

Server and infrastructure

  • SSH passphrases: When generating SSH keys with ssh-keygen, protect the private key with a strong passphrase.
  • Database root passwords: PostgreSQL, MySQL, Redis — root/admin accounts need 20+ character random passwords stored in a secrets manager.
  • Wi-Fi WPA3 passwords: Home and office Wi-Fi. 20+ characters or a 4-6 word passphrase.
  • Encryption keys: BitLocker, FileVault, LUKS, VeraCrypt — full disk encryption keys. Use 20+ characters minimum.

Development and DevOps

  • API keys for development environments: Staging, QA, and development API keys should be rotated regularly and stored in secret managers (AWS Secrets Manager, HashiCorp Vault).
  • Service account passwords: Machine-to-machine accounts need strong random passwords too — but prefer API keys and short-lived tokens where possible.
  • Temporary one-time passwords: Account provisioning workflows often require temporary passwords sent to users, which they must change on first login.
  • Test data and fixtures: Use random passwords in test fixtures (never real production passwords) to avoid accidental reuse.

Memorable passphrases

  • Master password for password manager: The one password you must remember. A 6-word Diceware passphrase is strong and memorable.
  • Laptop login password: You type it often, so use a passphrase you can type fluently instead of random characters.
  • Password to read aloud: If someone needs to tell a password over the phone, passphrases are far easier than random strings.

Worked examples

16-character strong password

Balanced length for most accounts.

Input
Settings: 16 chars, all classes, no ambiguous
Output
xK7#nP9$wE3@vR2m

20-character critical-account password

Recommended for email, banking, admin accounts.

Input
Settings: 20 chars, all classes
Output
qP$3vN7!xK2@mR9#bL4t

32-character password for encryption keys

Used for disk encryption, master keys, production secrets.

Input
Settings: 32 chars, all classes
Output
F7q!Kp3#Nm9@vR2$xL4&bT8*cJ6Y+wE1n

Passphrase mode (6 words)

Memorable, strong — good for master passwords.

Input
Settings: passphrase, 6 words, hyphen separator
Output
mountain-orbit-glass-whisker-radar-turmeric

PIN-style numeric password

For systems that only accept digits (old ATMs, some voicemail).

Input
Settings: 8 chars, digits only
Output
47295831

Pronounceable (no symbols, mixed case)

For systems with strict character rules.

Input
Settings: 14 chars, letters + digits, no symbols
Output
Kx7Pn3Mv2Lqr8T

How it works

Where the randomness comes from. Each character is drawn using crypto.getRandomValues() — the same cryptographically secure generator used for keys and tokens. That's the part that matters: a "random" password from a weak generator is guessable, no matter how long.

Entropy, and why length wins. Strength is measured in bits of entropy: length × log2(alphabet size). A 16-character password from the full ~94-character keyboard set is about 105 bits — far beyond brute-force reach. The key insight the "must contain a symbol" rules miss: length adds entropy faster than complexity. A long lowercase-only password beats a short one crammed with symbols. When in doubt, make it longer.

The strength meter here scores length and character-class variety and shows the estimated bits. Treat the bits number as the real signal; the label (Weak/Good/Strong) is a friendly summary.

Ambiguous characters. Excluding 0 O o 1 l I | trades a tiny amount of entropy for far fewer typos when a password has to be read off a screen or spoken aloud. For a password you'll only ever paste, leave them in.

Common problems and solutions

Reusing one strong password everywhere

A perfect password reused across sites is only as safe as the least secure site that stores it. One breach exposes them all. Generate a unique password per account and let a password manager remember them.

Chasing symbols instead of length

An 8-character password with symbols is weaker than a 20-character one without. Length adds entropy faster than complexity — prioritize making it longer over making it look complicated.

A site rejects the generated password

Some sites cap length or ban certain symbols. Use the exclude-characters field to drop the offending symbols, or shorten to fit — then compensate with a bit more length if allowed.

Excluding ambiguous characters on a paste-only password

That option lowers entropy slightly to prevent typos. It's worth it for passwords you type or dictate, but pointless for one you'll only copy-paste — leave the full alphabet in those.

Saving passwords in a plain file or screenshot

A generated password is only as safe as where you put it. Store it in a password manager, not a note, spreadsheet, or screenshot.

How it compares

Random password vs passphrase. A random string like k7$Pm2!qXvL9 is maximally dense but hard to remember. A passphrase (four to six random *words*) reaches the same entropy while being memorable — better for the handful of passwords you actually type, like your device login or password-manager master password. Use random strings for everything a manager remembers for you.

Generated vs "clever" human passwords. P@ssw0rd2024! looks complex but is weak — attackers know every substitution. Any output here is stronger than a human-invented one of the same length, because it's genuinely random.

This tool vs your password manager's generator. They do the same job. The right workflow is: let a manager generate *and store* a unique random password per site. Use this when you don't have a manager open, need a batch, or want a specific format.

Frequently asked questions about the Password Generator

Are these passwords actually random and safe to use?

Yes. They're generated with crypto.getRandomValues(), the browser's cryptographically secure RNG, entirely on your device. Nothing is sent to or created on a server.

Is the password stored or logged anywhere?

No. It exists only in your browser tab until you copy it. Close the tab and it's gone. You can confirm no network requests fire in your browser's dev tools.

How long should my password be?

12 characters is a reasonable floor; 16+ is comfortably strong for anything important. Because length drives entropy, going longer is the simplest way to get stronger — favor it over piling on symbols.

What does the bits number mean?

It's the entropy — roughly how many yes/no guesses an attacker would need. Each extra bit doubles the work. Above ~80 bits a password is effectively immune to brute force; the tool shows the estimate so you can compare options.

Random password or passphrase — which is better?

Same strength at equal entropy; the difference is memorability. Use a passphrase for the few passwords you must remember (device, manager master key) and random strings for everything a manager stores.

What does excluding ambiguous characters do?

It removes look-alikes (0/O, 1/l/I, |) so the password is easier to read and type without errors. It costs a little entropy, so only use it for passwords you'll enter by hand.

Additional resources

Advertisement

Related tools

All Generators

Learn more

Explore more tools

200+ free tools that run in your browser.

Browse all tools →