Password Generator

This password generator makes strong random passwords right in your browser, from 4 to 128 characters long. Tick the character sets you want, read the entropy figure as you change the settings, and copy or download the results. Nothing is sent anywhere or stored.

How to use this password generator

1. Set the length with the slider or the number box, anywhere from 4 to 128 characters. Longer beats fancier, so treat 16 as a floor for an account that matters.
2. Tick the character sets you want: lowercase letters, uppercase letters, digits and symbols. Each ticked set adds its characters to the pool the generator draws from.
3. Turn on the look-alike filter if the password will be read off a screen or read out loud. It leaves out characters such as l, 1, I, O and 0 that are easy to confuse.
4. Choose how many passwords to make in one batch, from 1 to 50. A batch is handy when you are setting up several accounts in one sitting.
5. Copy the password you want, or download the whole batch as a text file. Change any setting and a fresh batch appears, so you never have to settle for the first draw.

One rule is built into every password here: at least one character from every ticked set is guaranteed, placed in at random like the rest. A short password with all four sets ticked never comes out as letters only by accident.

What the entropy figure on this password generator tells you

Entropy is a way of counting how many guesses an attacker would need, on average, to land on a password of this shape. The readout on this page uses the standard formula: length times log2 of the pool size. With all four sets ticked, the pool holds 83 characters, so each character adds about 6.4 bits.

That makes the maths easy to feel. A 12 character password from the full pool lands at about 76 bits. Sixteen characters gives about 102 bits. Twenty characters gives about 128 bits, and the 128 character top setting passes 800 bits, far past anything a guessing attack can work through.

Current NIST guidance asks for at least 15 characters when a password alone protects an account, with no forced mix of character types and no regular forced changes. That is why length does more work here than exotic symbols do.

The entropy figure is honest on this page for one reason: these passwords are drawn at random, character by character. The same formula flatters a password a person invents, because people reach for names, dates and keyboard patterns that attackers try early. Random draw is what the number assumes, and random draw is what you get.

Details and limits of this password generator

Every character is picked with the secure random source built into your browser, using rejection sampling so no character in the pool is favoured over another. If a browser has no secure random source, this tool refuses to run rather than fall back on the ordinary random function, which follows a pattern a program can predict.

Generation happens on your device. Nothing is sent to a server, nothing is stored, and closing the tab throws the batch away. Save the password you pick in a password manager, because a text file sitting on the desktop is a poor vault.

Entropy is a work factor estimate, not a promise. A password can be strong and still be lost if a site stores passwords badly, if you type it into a lookalike page, or if you reuse it on a second site that leaks it. One password per account is the habit that carries the real weight.

Two smaller limits are worth knowing. The look-alike filter shrinks the pool a little, and the entropy readout drops to match, so the trade is shown rather than hidden. And some sites impose their own rules, such as a 20 character cap or a ban on certain symbols, so a generated password can need a small tweak before a site accepts it.