Skip to content
codevory

Password Generator

Generate strong random passwords with a secure random source. Choose the length and character types, and see the entropy of the result.

Password Generator: the tool

Passwords

Generating…

How to use Password Generator

  1. Set the length. Sixteen characters or more is a good choice for accounts that are stored in a password manager.
  2. Choose the character types: lowercase, uppercase, digits and symbols. Turn on Exclude look-alikes if you will read the password aloud or type it from paper.
  3. Set how many passwords you want. The line under the options shows the size of the alphabet and the entropy of each password.
  4. Press Generate for a new set, then copy one. Nothing is saved: the passwords exist only on this page until you leave it.

Example

Passwords look like this. It is only an illustration of the shape: yours will be different, and a password copied from a web page should never be used for a real account.

20 characters, all types
q7#Vm2!kXr9@Tz4pLw8$

About this tool

Every character is chosen with crypto.getRandomValues, the cryptographically secure random generator built into your browser, and not with Math.random, which is predictable and unsuitable for secrets. The characters are drawn uniformly: the tool rejects the few random values that would otherwise favour some characters, a bias that a plain remainder operation introduces.

Each type you select is guaranteed to appear at least once, which satisfies the rules of most sites. The remaining positions are filled from all selected types together, and the whole password is then shuffled with an unbiased Fisher-Yates shuffle, so the guaranteed characters do not sit at predictable positions.

The entropy shown is the length multiplied by the base-2 logarithm of the alphabet size: the number of bits of unpredictability if the password was drawn uniformly. Each extra bit doubles the number of possibilities. Passwords are generated in your browser, are never sent anywhere, and are not stored or logged.

What the entropy numbers mean

EntropyLabel hereMeaning
Under 40 bitsweakCan be guessed by a determined attacker with modest resources
40 to 59 bitsfairResists casual guessing but not a serious offline attack
60 to 79 bitsgoodReasonable for most accounts protected by a slow password hash
80 to 99 bitsstrongBeyond practical brute force for the foreseeable future
100 bits and morevery strongFar beyond any realistic brute-force attack

Frequently asked questions

Is it safe to generate a password on a web page?

The password is created in your browser from its secure random generator and is not sent to a server. Still, you are trusting the code of the page. For your most sensitive accounts, use the generator built into your password manager, and always save the result in one.

How long should a password be?

For accounts kept in a password manager, 16 to 20 random characters is a solid default and there is no cost to going longer. Use the longest length the site allows. Length matters more than adding symbols.

Why does every selected type appear at least once?

Many sites demand a lowercase letter, an uppercase letter, a digit and a symbol. Guaranteeing each type means the password is accepted on the first try. For lengths of 12 or more the effect on entropy is negligible.

Why would I exclude look-alike characters?

I, l, 1, O and 0 are easy to confuse in many fonts. Excluding them helps when a password has to be read aloud or copied by hand, at a small cost in entropy per character.

A site rejects my password because of a symbol. What should I do?

Turn Symbols off and raise the length. A longer password made of letters and digits can be as strong as a shorter one with symbols: at 24 characters, letters and digits alone give about 143 bits.

Does the tool keep a history of generated passwords?

No. Passwords are kept only in the memory of this tab. Reload the page and they are gone.

More developer tools