Every password is created inside your own browser using the operating system cryptographic random generator. Nothing is transmitted, logged or stored on a server.
This password generator builds random passwords from 4 to 64 characters long using the cryptographic random number generator built into your browser. You choose which character sets go into the pool: lowercase, uppercase, digits and symbols. You can also drop the characters that people confuse when reading a password aloud or copying it by hand, and force at least one character from every set you selected.
Under the results you get an entropy figure in bits, calculated as the base-2 logarithm of the pool size multiplied by the password length. That number tells you how many guesses an attacker would need on average, and it is a far better measure than the coloured bars most sites show. Generate one password at a time, or ten at once when you are setting up several accounts.
How to use the Password Generator
- Drag the slider to the length you want, between 4 and 64 characters.
- Tick the character sets to include: lowercase, uppercase, digits and symbols.
- Optionally exclude look-alike characters and require one character from each selected set.
- Choose 1, 5 or 10 passwords, press Generate, then use the Copy button to paste it into your password manager.
Frequently asked questions
Are the passwords sent anywhere?
No. The tool runs entirely in your browser using window.crypto.getRandomValues. No password is transmitted to a server, written to a database or kept after you close the page. Reloading the page clears everything that was generated.
How long should a password be?
For an account protected by a password manager, 16 to 20 random characters with mixed sets is comfortable and sits above 90 bits of entropy. Anything you must type by hand can be shorter, but never go below 12 random characters for an account that matters.
What does the entropy figure mean?
Entropy is log2(pool size) multiplied by length, expressed in bits. Each extra bit doubles the number of guesses needed. Under 40 bits is weak, 40 to 60 is fair, 60 to 80 is strong and 80 or more is very strong against offline cracking.
Why exclude look-alike characters?
The lowercase l, digit 1, uppercase I, uppercase O and digit 0 are easy to mix up in many fonts. Removing them helps when a password has to be read from a screen, dictated on a call or typed on a device with no clipboard. It slightly shrinks the pool, so add a character or two.