Password Generator

Create random passwords that cannot be guessed from patterns. Pick a length from 4 to 128 characters, choose which character sets to use, and generate up to 20 at once. For something you need to type or remember, switch to passphrase mode, which joins random words from the EFF short word list. Each result shows an entropy estimate and a plain-text strength label.

Random & Generators Runs in your browser

Generate a Strong Random Password

How to Use the Password Generator

Choose Random characters or Passphrase.
Set the length (or number of words) and the character sets. At least one set is required.
Press Generate. Use Copy next to a password, or the show/hide option if someone may be looking at your screen.
Save the password in a password manager rather than in a text file or message.

About This Tool

Anyone creating or rotating account passwords, IT staff generating temporary credentials, and people who prefer a random passphrase to a password they can remember but others could guess.

Input: Your options · Output: Passwords or passphrases.

Features and Limitations

Features

Uses the browser's cryptographic random generator with rejection sampling, so every character is equally likely (no modulo bias).
Guarantees at least one character from each selected set, with optional exclusion of look-alike characters and optional no-repeat rule.
Custom symbol set, length 4–128 and 1–20 passwords per click.
Passphrases from the 1,296-word EFF short list (EFF wordlist, CC BY 3.0), with optional capitalisation and a digit.
Entropy in bits and a strength label written in words.

Limitations

Entropy is the theoretical strength of the generation method assuming the attacker knows your settings; it says nothing about whether a site stores your password safely.
Strength labels are rough guides: under 28 bits very weak, under 36 weak, under 60 fair, under 80 strong, 80 or more very strong. Use a unique password for every account.
Requiring at least one character of each set, or forbidding repeats, slightly reduces the possible combinations; the entropy shown is calculated from the pool and length, so treat it as an estimate.
Some sites reject certain symbols or limit the length. Adjust the symbol set if a site refuses a password.
If your browser lacks crypto.getRandomValues the tool refuses to generate rather than fall back to a weak generator.
Results are computed in your browser; nothing you enter is sent to a server.

Example

A 16-character password from all four sets with the default 23 symbols uses a pool of 85 characters, giving about 16 × log2(85) ≈ 102.6 bits of entropy. A 5-word passphrase from the 1,296-word list gives 5 × 10.34 ≈ 51.7 bits.

Frequently Asked Questions

Are the passwords really random and private?

They are generated locally with crypto.getRandomValues, the browser's cryptographically secure source, using rejection sampling to avoid bias. Nothing is sent to a server or stored, and no analytics script sees them.

How long should a password be?

For accounts you protect with a manager, 16 or more random characters is a common recommendation. Length adds strength faster than adding symbol types.

What is a passphrase and is it safe?

A passphrase is several random words, easy to type and remember. Random words from a list of 1,296 give about 10.3 bits each, so use at least 6 words for important accounts and 7 or more if the attacker can make unlimited offline guesses.

What does entropy in bits mean?

It measures how many guesses an attacker would need if they knew how the password was generated: each extra bit doubles the possibilities. 60 bits is about a billion billion combinations.

Why exclude look-alike characters?

Characters such as 0 and O or 1 l I are easy to confuse when you read a password aloud or type it from paper. Excluding them makes transcription easier and slightly reduces strength.