Password Generator
Generate strong, random passwords with custom length, symbols, numbers and mixed case — created securely in your browser.
About the Password Generator
This free password generator creates strong, random passwords instantly and securely. Choose a length from 8 to 64 characters, toggle uppercase letters, lowercase letters, numbers and symbols, and optionally exclude ambiguous characters like 0, O, 1, l and I that are easy to confuse when typing a password by hand.
Randomness comes from your browser's crypto.getRandomValues API — a cryptographically secure random number generator, not the predictable Math.random used by many simple tools. Generation happens entirely on your device: the password is never transmitted, stored or logged anywhere, so nobody, including this site, ever sees it.
A live strength meter estimates the entropy of your settings in bits and rates the password from Weak to Very strong. As a rule of thumb, aim for at least 60–80 bits: a 16-character password using all four character sets provides roughly 100 bits, far beyond what current hardware can brute-force.
How to Use the Password Generator
- 1Set the password length with the slider (8–64 characters).
- 2Tick the character types to include: uppercase, lowercase, numbers, symbols.
- 3Optionally exclude ambiguous characters like 0, O, 1, l and I.
- 4Click "Generate new password" and copy the result.
Frequently Asked Questions
What makes a password strong?
Length and randomness matter far more than clever substitutions. A random 16-character password mixing upper case, lower case, digits and symbols has around 100 bits of entropy — effectively uncrackable by brute force. "P@ssw0rd2024" looks complex but appears in cracking dictionaries; a truly random string does not.
Is it safe to generate a password online?
With this tool, yes. The password is produced by crypto.getRandomValues running inside your own browser; nothing is sent over the network, saved or logged. You can verify this by loading the page, disconnecting from the internet, and generating — it works fully offline.
How long should my password be in 2026?
Use at least 16 characters for important accounts (email, banking, password manager master password) and 12 as an absolute minimum elsewhere. Every extra character multiplies cracking time enormously — moving from 12 to 16 characters with a full character set adds roughly 26 bits, over 60 million times more combinations.
What does the entropy figure mean?
Entropy measures unpredictability in bits: each bit doubles the number of guesses an attacker needs. It is calculated as length × log2(size of the character pool). Under 40 bits is weak, 60+ is strong for online attacks, and 90+ resists even offline cracking with modern GPUs for the foreseeable future.
Why exclude ambiguous characters like 0 and O?
In many fonts the digit 0 and letter O, or 1, lowercase l and uppercase I, look nearly identical. If you ever need to read the password off paper or type it on a TV or router, those characters cause failed logins. Excluding them slightly reduces entropy — compensate by adding a character or two of length.
Should I use a different password for every site?
Yes, always. When one website is breached, attackers try the leaked email-password pairs everywhere else (credential stuffing). Unique random passwords contain the damage to the breached site. Use a password manager to store them — you only need to memorise one strong master password.