Password Generator

Generate strong random passwords with configurable length and character sets.

Strength —

Password length 12

Characters to include

A-Z uppercase a-z lowercase 0-9 numbers !@# symbols

Passwords are generated in your browser and never sent anywhere.

What this tool does

Choose a length (6–32 characters) and character types (uppercase, lowercase, digits, symbols) to generate a random password, then tap the password box to copy it. Every time you move the slider or change a checkbox a new password is generated and the strength bar updates. Use it for new sign-ups, replacing old passwords, or setting a Wi-Fi or router password. Everything is generated in your browser and the password is never sent anywhere.

How it is calculated

The selected character types are merged into one pool: 26 uppercase, 26 lowercase, 10 digits and 26 symbols (!@#$%^&*()_+-=[]{}|;:,.<>?), for 88 characters when all four are on. Each position is then drawn with the browser's cryptographic random generator, crypto.getRandomValues. To avoid modulo bias, where earlier characters would come up slightly more often, random values outside an even range are discarded and redrawn. The strength label is the entropy of a randomly drawn password: length × log2(pool size), in bits. Under 40 bits is weak, 40–60 medium, 60–80 strong and 80 or more very strong, and the bar fills at 100 bits. With all four types (88 characters, about 6.46 bits each), 6 characters is weak, 7–9 medium, 10–12 strong (the default 12 is about 77 bits) and 13 or more very strong. With digits only (about 3.32 bits each), up to 12 characters is weak and 25 or more is very strong. For reference, 16 characters from the 88-character pool give about 2 to the power of 103 combinations, far beyond practical brute force.

On load, a password is already generated with the defaults (12 characters, all four types)

Move the length slider to the number of characters you want; 16 or more is recommended

Tick the character types to include. With none selected, a prompt to choose options appears

Tap the password box to copy it; the badge briefly confirms the copy

Not happy with it? Nudge the slider and move it back to draw a new one

Things to know

Length matters far more than complexity. A 20-character password of lowercase and digits has about as many combinations as a 16-character one using all four types.

With only one type selected you need more length for the same strength: digits only need 25 characters and lowercase only 18 to reach 'very strong' (80 bits or more).

There is no guarantee each selected type appears at least once. If a site requires a digit, check that the result contains one.

Some sites reject symbols or accept only some. Turn symbols off and add four or more characters instead.

Do not try to memorize generated passwords; store them in a password manager and use a different one for every site. Reusing leaked passwords on other sites is the most common attack.

Even a strong password needs two-factor authentication to stop a leak from becoming a break-in.

On a shared computer, copy something else afterwards so the password does not linger in the clipboard.

Frequently asked questions

Are generated passwords stored on a server?

No. The page makes no network requests to generate them and stores nothing. Refreshing discards the password, so move the one you use into a password manager right away.

How long should a password be?

16 or more characters for everyday accounts and 20 or more for important ones such as email and banking. If a password manager fills them in, longer passwords cost you nothing.

Do I have to include symbols?

Symbols increase combinations at the same length, but adding a few characters does more. If a site will not accept symbols, make up for it with length.

Why cryptographic randomness instead of Math.random?

Ordinary random generators can be predicted once their internal state is worked out. Unpredictability is the whole point of a password, so this tool uses crypto.getRandomValues.