Password Generator
Generate a random password using the browser's cryptographically secure random number generator, mixing uppercase, lowercase, digits, and symbols.
- 1Enter your desired password length (default 16)
- 2View the generated password
- 3Copy it and store it in a password manager
How this generator creates a password
The tool builds a password from a pool of 70 characters: 26 uppercase letters, 26 lowercase letters, 10 digits and the symbols ! @ # $ % ^ & *. Each position is chosen using crypto.getRandomValues(), the cryptographically secure random number generator built into your browser, rather than the predictable Math.random(). You supply the length (the default is 16). Generation happens locally, so the password is never transmitted.
How long should a password be?
Strength comes mostly from length and true randomness. With a 70-character pool each character adds about 6.1 bits of entropy:
| Length | Approx. entropy | Suitable for |
|---|---|---|
| 12 | ~74 bits | Low-risk accounts that also have 2-factor authentication |
| 16 | ~98 bits | Most personal accounts |
| 20 | ~123 bits | Email, banking, password-manager master passwords |
These figures assume the password is truly random and used only for one account. A random 16-character password is far beyond the reach of brute-force guessing against any properly designed service.
What to do with a generated password
- Generate it, then copy it straight into a password manager or the account's password field.
- Use one unique password per site. Reuse is the most common way a single data breach turns into several compromised accounts.
- Turn on two-factor authentication for email, banking and any account that can reset others.
- Do not store the password in a notes file, a screenshot or an email to yourself.
Things to know about this tool
- Characters are not guaranteed from every group. Because each position is picked independently, a short password can occasionally lack a digit or a symbol. If a website insists on all four character types, simply generate again or lengthen the password.
- Some sites reject certain symbols. A few systems restrict special characters. If you are rejected, regenerate until the symbols fit, or remove the offending character and add another letter.
- Easy-to-confuse characters can appear. The letters O and l and the digits 0 and 1 can all show up. Copy and paste rather than retyping.
- It is a generator, not a vault. The tool does not save anything. Once you leave the page the password is gone, so store it before you close the tab.
Random passwords versus passphrases
For credentials you must type from memory, such as a device login or a password manager's master password, a passphrase of four to six randomly chosen words is easier to remember at comparable strength. For everything else, a long random string stored in a password manager is the better choice because you never need to remember or type it.
Related tools
Need unique identifiers rather than secrets? See the UUID v4 generator. To encode data for safe transport, try the Base64 encoder.