Utilities
Password Generator
Choose the length and the kinds of characters, then generate. Passwords come from your browser's cryptographic random generator and are never sent, stored or logged — close the tab and they are gone.
Choose your settings and press Generate. The password is created in your browser and never sent anywhere.
How to use this tool
- Set the length. Sixteen characters is a sound default; longer is stronger.
- Choose which kinds of characters to include. Every chosen kind is guaranteed to appear at least once.
- Tick “Avoid look-alike characters” if you will read the password aloud or type it from paper.
- Press Generate, then copy the password into your password manager.
Formula and method
Strength (entropy)
bits = length × log₂(number of possible characters)Each extra bit doubles the number of guesses an attacker needs. Sixteen characters from all four sets gives about 103 bits.
Worked examples
16 characters, all four sets
- Pool: 26 + 26 + 10 + 25 = 87 characters
- 16 × log₂(87) ≈ 103 bits
Very strong — far beyond what any brute-force attack can guess.
8 digits only
- 8 × log₂(10) ≈ 27 bits
Weak — about 100 million possibilities, which a computer can try quickly.
Notes and limitations
- Characters are chosen with the browser's crypto.getRandomValues and an unbiased selection method, not Math.random.
- Nothing is generated until you ask, so no password ever appears in the page's HTML or leaves this tab.
- The strength shown measures how the password was generated. It is not a checker for passwords you invent yourself.
- A strong password is only half the job: use a different one for every account, keep them in a password manager, and turn on two-factor authentication where offered.
Frequently asked questions
How long should a password be?
Current guidance, including NIST's, favours length over forced complexity. Sixteen or more random characters is a comfortable margin for accounts you care about.
Is it safe to generate a password on a website?
It is safe here because the password is created by your own browser and never transmitted. As a rule, avoid generators that create passwords on their server, since you cannot know what happens to them.
Why avoid look-alike characters?
Characters such as I, l and 1, or O and 0, are easy to confuse when reading or typing by hand. Leaving them out costs a little strength but prevents lock-outs.
Do I need symbols?
Not necessarily. A longer password without symbols can be as strong as a shorter one with them. Include symbols when a site requires them.