Strong random password generator
🔒 Generated in this page, never sent anywhere
Pick a length, pick which characters to allow, and take the result. Every character comes from your browser's own cryptographic random number generator — there is no server involved at any point, so there is nothing to log.
Crack times assume an offline attack at 10¹² guesses per second — a deliberately pessimistic figure. A login form allows nothing close to that.
🔒 Passwords are produced inside this page by your browser’s own cryptographic random number generator (crypto.getRandomValues). Nothing is sent to a server and nothing is stored — close the tab and it is gone.
How long is long enough?
Length is the only setting that really moves the needle. Each extra character multiplies the search space by the size of the alphabet, so adding one character to a 12-character password does more for you than any amount of rearranging the ones already there. With all four sets enabled there are 85 characters to draw from, which works out at about 6.4 bits per character:
| Length | Entropy | Time to guess |
|---|---|---|
| 8 | 51 bits | About 20 minutes |
| 12 | 77 bits | About 2,000 years |
| 15 | 96 bits | About a billion years |
| 16 | 103 bits | About 100 billion years |
| 20 | 128 bits | Longer than the universe has existed |
| 32 | 205 bits | Not a meaningful number |
Those times assume an offline attack running 1012 guesses a second — someone who has stolen the site's password database and is grinding through it on their own hardware. It is a deliberately unkind assumption: a login form that is working properly allows a handful of attempts a minute, not a trillion a second.
The practical reading of that table is that eight characters is finished, twelve is the floor for anything you would mind losing, and sixteen is where the number stops being interesting. Beyond twenty you are buying protection against nothing that exists. Use the longest length the site will accept for your email account and your password manager, because those two are the keys to everything else.
Where the randomness comes from
The generator draws from crypto.getRandomValues, the browser's interface to the operating system's cryptographically secure random source. It is notMath.random, which is a fast non-cryptographic PRNG whose internal state can be reconstructed from a few of its outputs — a password built on it looks exactly as random as a real one and is not. If a browser cannot provide the secure source, this page refuses to generate anything rather than quietly falling back.
There is a second, subtler trap: converting a random 32-bit number into "a random position in an alphabet of 84" with the obvious modulo operation is biased, because 232is not a multiple of 84. Some characters would come up slightly more often than others, forever, in a way an attacker can measure and exploit. This generator throws away the uneven tail of the range and draws again, which removes the bias completely.
Why the symbol set is short
Quotes, backslashes, backticks, angle brackets, pipes and spaces are all missing on purpose. They are the characters that get mangled between the box you type them into and wherever they end up: shells eat them, CSV exports split on them, badly written forms reject them, and a surprising number of sites silently truncate a password at the first one. The 23 symbols that are included still contribute more entropy per character than the digits and the letters, without the chance of locking yourself out of an account.
Look-alike characters
The "exclude look-alikes" option removes capital I, lowercase l, the digit 1, capital O and the digit 0. Turn it on when a human being is going to read the password off a screen and type it somewhere else — a Wi-Fi key on a TV, a password read out over the phone, anything printed. Leave it off otherwise: it costs a small amount of entropy and buys nothing if the password is only ever going to be copied and pasted.
What to do with it afterwards
A generated password is only useful if you never have to remember it, which means it belongs in a password manager — the one built into your browser is fine, and the dedicated ones are better. Generate, paste into the manager, forget it existed. That is the whole workflow, and it is what makes a unique password per site possible at all.
Do not email it to yourself, put it in a note, or send it over chat. If you must hand a password to another person, hand them a one-time link from a sharing tool that expires, or say it out loud. And change it if — and only if — you have reason to think it has leaked: the periodic 90-day rotation policy still enforced in many workplaces was dropped fromNIST SP 800-63Byears ago, because in practice it makes people cycle through Summer2024!,Summer2025! and so on.
Questions
Is it safe to generate a password on a website?
It is a fair thing to be suspicious of, and you should not take our word for it. This page is static: the generator is JavaScript that has already been downloaded by the time you see the result. Turn off your Wi-Fi, press "Generate again", and it keeps working — there is nothing for it to talk to. That is the test worth running on any tool like this one.
If you want the strongest answer available, use the generator built into your password manager. It runs in software you already trust with the passwords themselves, which is a shorter chain than any web page can offer.
Do you store or log the passwords?
No — and more usefully, there is no mechanism by which we could. The password is created inside your browser and written into the page you are looking at. Nothing is sent when you press the button, nothing is written to local storage, and reloading the page destroys it.
Why does the site I am registering with reject the password?
Almost always a length cap or a banned symbol. Try 16 characters with symbols turned off first; if that is accepted, the site has an undocumented rule about which symbols it allows. A site that caps passwords at 12 characters, or bans symbols outright, is telling you something about how it stores them.
What about passphrases — four random words?
They are an excellent choice for the handful of passwords you have to type by hand, like your device login and your password manager's master password, because they are far easier to remember at equal strength. For the other few hundred accounts, which live in the manager and are never typed, a random string is simpler and shorter. This tool generates strings; a good diceware list generates the phrases.
Are the "time to guess" figures real?
They are arithmetic, not measurement: half the search space divided by an assumed guess rate. The assumption is stated on purpose, because a strength meter that hides its assumptions is just a coloured bar. Real attacks are usually far cheaper than brute force — they start with passwords leaked from other sites, which is why reusing one matters more than how long it is.