Password Generator
GeneratorsGenerate strong, cryptographically secure random passwords. Free, private — all processing in your browser.
This generates strong, random passwords in your browser — pick a length, choose which character types to include, and get one or a batch at once, each with a live strength read and its entropy in bits. Presets cover the common cases (a 4-digit PIN, a quick 8-character login, a 16-character default, a 32-character maximum), or dial in your own.
The randomness comes from your browser's cryptographic random source, not Math.random(), and nothing is generated on or sent to a server — the password exists only on your screen until you copy it. There are also practical switches: exclude ambiguous characters (0/O, 1/l/I) for passwords you'll type by hand, or exclude specific characters a particular site rejects.
What the Password Generator can do
Cryptographically secure randomness
Uses Web Crypto API (crypto.getRandomValues), the same CSPRNG used by TLS. Not Math.random. Suitable for real cryptographic use.
Customizable length
Generate passwords from 8 to 128 characters. Longer is always stronger. We recommend 16+ for most accounts, 20+ for critical accounts.
Character class toggles
Include or exclude uppercase letters, lowercase letters, digits, and symbols. Every enabled class guarantees at least one character of that type in the output.
Exclude ambiguous characters
Remove visually similar characters (0/O, 1/l/I, {, }, ``, etc.) to avoid transcription errors when typing passwords manually or reading them from printed lists.
Passphrase mode
Generate human-memorable passphrases using Diceware-style word lists. 6 words ≈ 77 bits of entropy — strong and easy to remember.
Bulk generation
Generate up to 100 unique passwords at once. Useful for provisioning multiple service accounts, test fixtures, or one-time access credentials.
Real-time strength meter
See the estimated entropy (in bits) and crack time for every generated password. Know exactly how strong your password is.
Copy and download
Copy to clipboard with one click, or download bulk-generated passwords as a CSV or TXT file for secure storage in your password manager.
No tracking, no logging
Passwords are generated entirely in your browser. Nothing is transmitted, stored, or analyzed. Open the Network tab in DevTools to verify zero outbound requests.
How to use the Password Generator
- 1
Choose password length
Set the length slider. 12 characters minimum, 16+ recommended for most accounts, 20+ for high-value accounts (banking, email, crypto wallets).
- 2
Select character classes
Enable uppercase, lowercase, digits, and symbols. More classes means more entropy per character. For systems that reject symbols, disable them — but increase length to compensate.
- 3
Exclude ambiguous characters if needed
Enable this if you will ever need to read the password off a screen or printed page. Skips characters that look similar in common fonts.
- 4
Click Generate
A new password appears instantly. Click Generate again for a different one. The strength meter shows how resistant it is to brute force.
- 5
Copy to your password manager
Click Copy and paste into your password manager (1Password, Bitwarden, KeePass, etc.). Never memorize and reuse — let the manager store one unique password per account.
- 6
For passphrases, switch to passphrase mode
If the account allows long passwords and you need to type it occasionally, use passphrase mode. 6 words separated by hyphens is typical.
Where this helps
Personal and workplace accounts
- →Email accounts: Email is the master key to most other accounts (password reset). Use 20+ character passwords with all character classes.
- →Banking and finance: Banks, brokers, and crypto exchanges should have their own unique 20+ character password and two-factor authentication.
- →Social media: Compromised social accounts can be used for phishing your contacts. Use 16+ characters, unique per platform.
- →Work SaaS accounts: Slack, Notion, Jira, GitHub, Google Workspace — each needs a unique password. Use your company's SSO or password manager.
Server and infrastructure
- →SSH passphrases: When generating SSH keys with ssh-keygen, protect the private key with a strong passphrase.
- →Database root passwords: PostgreSQL, MySQL, Redis — root/admin accounts need 20+ character random passwords stored in a secrets manager.
- →Wi-Fi WPA3 passwords: Home and office Wi-Fi. 20+ characters or a 4-6 word passphrase.
- →Encryption keys: BitLocker, FileVault, LUKS, VeraCrypt — full disk encryption keys. Use 20+ characters minimum.
Development and DevOps
- →API keys for development environments: Staging, QA, and development API keys should be rotated regularly and stored in secret managers (AWS Secrets Manager, HashiCorp Vault).
- →Service account passwords: Machine-to-machine accounts need strong random passwords too — but prefer API keys and short-lived tokens where possible.
- →Temporary one-time passwords: Account provisioning workflows often require temporary passwords sent to users, which they must change on first login.
- →Test data and fixtures: Use random passwords in test fixtures (never real production passwords) to avoid accidental reuse.
Memorable passphrases
- →Master password for password manager: The one password you must remember. A 6-word Diceware passphrase is strong and memorable.
- →Laptop login password: You type it often, so use a passphrase you can type fluently instead of random characters.
- →Password to read aloud: If someone needs to tell a password over the phone, passphrases are far easier than random strings.
Worked examples
16-character strong password
Balanced length for most accounts.
Settings: 16 chars, all classes, no ambiguous
xK7#nP9$wE3@vR2m
20-character critical-account password
Recommended for email, banking, admin accounts.
Settings: 20 chars, all classes
qP$3vN7!xK2@mR9#bL4t
32-character password for encryption keys
Used for disk encryption, master keys, production secrets.
Settings: 32 chars, all classes
F7q!Kp3#Nm9@vR2$xL4&bT8*cJ6Y+wE1n
Passphrase mode (6 words)
Memorable, strong — good for master passwords.
Settings: passphrase, 6 words, hyphen separator
mountain-orbit-glass-whisker-radar-turmeric
PIN-style numeric password
For systems that only accept digits (old ATMs, some voicemail).
Settings: 8 chars, digits only
47295831
Pronounceable (no symbols, mixed case)
For systems with strict character rules.
Settings: 14 chars, letters + digits, no symbols
Kx7Pn3Mv2Lqr8T
How it works
Where the randomness comes from. Each character is drawn using crypto.getRandomValues() — the same cryptographically secure generator used for keys and tokens. That's the part that matters: a "random" password from a weak generator is guessable, no matter how long.
Entropy, and why length wins. Strength is measured in bits of entropy: length × log2(alphabet size). A 16-character password from the full ~94-character keyboard set is about 105 bits — far beyond brute-force reach. The key insight the "must contain a symbol" rules miss: length adds entropy faster than complexity. A long lowercase-only password beats a short one crammed with symbols. When in doubt, make it longer.
The strength meter here scores length and character-class variety and shows the estimated bits. Treat the bits number as the real signal; the label (Weak/Good/Strong) is a friendly summary.
Ambiguous characters. Excluding 0 O o 1 l I | trades a tiny amount of entropy for far fewer typos when a password has to be read off a screen or spoken aloud. For a password you'll only ever paste, leave them in.
Common problems and solutions
⚠Reusing one strong password everywhere
A perfect password reused across sites is only as safe as the least secure site that stores it. One breach exposes them all. Generate a unique password per account and let a password manager remember them.
⚠Chasing symbols instead of length
An 8-character password with symbols is weaker than a 20-character one without. Length adds entropy faster than complexity — prioritize making it longer over making it look complicated.
⚠A site rejects the generated password
Some sites cap length or ban certain symbols. Use the exclude-characters field to drop the offending symbols, or shorten to fit — then compensate with a bit more length if allowed.
⚠Excluding ambiguous characters on a paste-only password
That option lowers entropy slightly to prevent typos. It's worth it for passwords you type or dictate, but pointless for one you'll only copy-paste — leave the full alphabet in those.
⚠Saving passwords in a plain file or screenshot
A generated password is only as safe as where you put it. Store it in a password manager, not a note, spreadsheet, or screenshot.
How it compares
Random password vs passphrase. A random string like k7$Pm2!qXvL9 is maximally dense but hard to remember. A passphrase (four to six random *words*) reaches the same entropy while being memorable — better for the handful of passwords you actually type, like your device login or password-manager master password. Use random strings for everything a manager remembers for you.
Generated vs "clever" human passwords. P@ssw0rd2024! looks complex but is weak — attackers know every substitution. Any output here is stronger than a human-invented one of the same length, because it's genuinely random.
This tool vs your password manager's generator. They do the same job. The right workflow is: let a manager generate *and store* a unique random password per site. Use this when you don't have a manager open, need a batch, or want a specific format.
Frequently asked questions about the Password Generator
▶Are these passwords actually random and safe to use?
Yes. They're generated with crypto.getRandomValues(), the browser's cryptographically secure RNG, entirely on your device. Nothing is sent to or created on a server.
▶Is the password stored or logged anywhere?
No. It exists only in your browser tab until you copy it. Close the tab and it's gone. You can confirm no network requests fire in your browser's dev tools.
▶How long should my password be?
12 characters is a reasonable floor; 16+ is comfortably strong for anything important. Because length drives entropy, going longer is the simplest way to get stronger — favor it over piling on symbols.
▶What does the bits number mean?
It's the entropy — roughly how many yes/no guesses an attacker would need. Each extra bit doubles the work. Above ~80 bits a password is effectively immune to brute force; the tool shows the estimate so you can compare options.
▶Random password or passphrase — which is better?
Same strength at equal entropy; the difference is memorability. Use a passphrase for the few passwords you must remember (device, manager master key) and random strings for everything a manager stores.
▶What does excluding ambiguous characters do?
It removes look-alikes (0/O, 1/l/I, |) so the password is easier to read and type without errors. It costs a little entropy, so only use it for passwords you'll enter by hand.
Additional resources
- NIST SP 800-63B — Digital Identity Guidelines — Official US government guidance on password policies (length, rotation, storage).
- EFF Long Wordlist for Diceware — 7,776-word list for generating memorable Diceware passphrases.
- Have I Been Pwned — Check if your email or password has appeared in a data breach.
- Web Crypto API — getRandomValues — MDN reference for the cryptographic random function used by this tool.
- XKCD 936 — Password Strength — The famous "correct horse battery staple" explanation of passphrase strength.
Related tools
All GeneratorsBcrypt Hash Generator
Hash passwords with bcrypt and verify existing hashes — configurable rounds
Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-512 hashes for text and files
HMAC Generator
Generate HMAC signatures (SHA-256, SHA-512) for API auth and webhook verification
JWT Generator
Create signed JSON Web Tokens (JWT) with custom claims — HS256, RS256, ES256
Password Strength Checker
Test password strength with entropy score, crack-time estimate, and breach check
Random Color Generator
Generate random colors in hex, RGB, or HSL with control over saturation, lightness, and hue range for specific moods or palettes.
Learn more
Explore more tools
200+ free tools that run in your browser.
Browse all tools →