✲Password Generator
Generate strong random passwords in your browser, with entropy and pool size shown.
Generated with your browser's cryptographic random number generator. Nothing is sent anywhere.
Length beats complexity, and almost every password rule you have been given gets this backwards.
A twenty-character password drawn from lowercase letters alone is harder to crack than a ten-character one crammed with symbols. Each additional character multiplies the search space; each additional character set only widens it. That is why the default here is twenty characters rather than the eight-with-a-symbol that most sites still demand, and why the entropy figure is displayed at all — it is the number that actually tells you something.
Entropy is measured in bits, and every extra bit doubles the work an attacker faces. Under 50 bits is weak against an offline attack on a leaked database. Around 70 is reasonable for ordinary accounts. Past 100 you are comfortably beyond anything that will be brute-forced this century, and the defaults on this page land well above that.
The look-alikes option
Turning it on removes characters that get confused when a password is read aloud, typed from a screenshot, or dictated over the phone — capital O against zero, capital I against lowercase l against the digit one. It costs you a few bits of entropy and saves a support call. Worth it for anything a human will ever retype, pointless for something going straight into a password manager.
A detail most generators get wrong
Randomness here comes from the browser cryptographic generator, not Math.random, and the character selection is rejection-sampled. That second part matters more than it sounds: taking a random number modulo the pool size makes the earlier characters in the pool slightly more likely, which is a real and unnecessary bias. Rejecting the values that would skew it removes that entirely.
Nothing is transmitted. The password exists in the page you are looking at and nowhere else.
Two habits worth changing
Stop rotating passwords on a schedule. NIST dropped that advice years ago because forced rotation pushes people toward predictable variations — the same password with an incrementing number. Change a password when you have reason to think it is exposed.
And use a manager. A generator only helps if every account gets a different password, and nobody memorises thirty of these.
This tool is provided free of charge for general information and convenience only. It runs in your browser and we do not store the data you enter. We make no guarantee as to the accuracy, completeness, or suitability of any result, and accept no liability for any loss, damage, or decision arising from its use — use it at your own risk. See our Terms & Conditions.