Password Generator

Generate a strong random password using your browser's cryptographic random source. Nothing is transmitted, logged or stored — the password exists only on your device.

Your data never leaves your browser. This tool runs entirely on your device.

Length beats complexity

Password strength is measured in entropy — the number of guesses an attacker must make on average. It depends on two things only: how many characters are possible at each position, and how many positions there are.

Length wins decisively, because entropy grows linearly with length but only logarithmically with the size of the alphabet. Adding one character to a lowercase password buys 4.7 bits; switching that same password to include symbols buys about 1.9 bits per character. This is why a long passphrase beats a short jumble of punctuation.

entropy (bits) = length × log₂(alphabet size)

8 characters, all types → 52 bits — hours to days offline
12 characters, all types → 79 bits — centuries
16 characters, all types → 105 bits — beyond reach
20 characters, all types → 131 bits — permanently beyond reach

Where the randomness comes from

Every character is drawn using crypto.getRandomValues, the browser's cryptographically secure random source. Math.random is never used: it is seeded predictably and its output can be reconstructed by an attacker who knows roughly when a password was generated.

The reduction from a random number to a character index uses rejection sampling. Taking a random number modulo the alphabet size would make the first few characters of the alphabet slightly more likely — a small bias, but a real and unnecessary loss of entropy.

The composition rules are mostly theatre

Requirements like "must contain an uppercase letter and a symbol" were designed to stop people choosing "password". Against a randomly generated password they add nothing, and they very slightly reduce entropy by shrinking the space of valid outputs.

The option is provided here because many sites enforce those rules and will reject an otherwise excellent password. It is on by default for that practical reason, not a security one.

Use a password manager

A generated password is only useful if it is unique to one site. The overwhelming majority of account compromises come from credential stuffing — reusing a password that leaked somewhere else — not from anyone cracking a strong password.

That means you need a different strong password for every account, which is impossible to memorise and exactly what a password manager is for. Generate directly in the manager where you can; use this tool when you cannot.

Privacy

Generation happens entirely in your browser. The page makes no network request with the password, nothing is logged, and nothing is stored. Even so, a password you have pasted into any web page is best treated as one to rotate if it protects something important.

Frequently asked questions

How long should a password be?

Sixteen characters with mixed types gives about 105 bits of entropy, which is beyond any realistic offline attack. Twelve is acceptable for ordinary accounts; use twenty or more for email, banking and a password manager master key.

Are these passwords really random?

Yes. Each character is drawn from crypto.getRandomValues, the browser's cryptographic random source, using rejection sampling so no character is more likely than another. Math.random is never used.

Is it safe to generate a password on a website?

On this one, generation happens entirely in your browser with no network request, so nothing leaves your device. That said, generating inside your password manager is better practice still, because the password never touches a web page at all.

Are symbols better than a longer password?

No. Adding symbols to a 12-character password buys roughly 23 bits; adding four more characters buys about 26. Length is the cheaper and more reliable lever, and long passwords are easier to type.

Why would I exclude look-alike characters?

Because 0 and O, or 1 and l and I, are easy to confuse when a password has to be read aloud, copied from a screen or typed from a printout. It costs a little entropy, which you can recover by adding a character or two.

Should I change my passwords regularly?

No. Both NIST and the UK NCSC now advise against scheduled rotation: it pushes people toward predictable variations like Summer2024 then Autumn2024. Change a password when there is a reason to — a breach, or a suspicion it leaked.