Password Generator
Generate secure passwords and see the entropy behind them.
Character Sets
Options
o^SCSW9k0%_gv:6Rixi_
Entropy measures these settings, not this particular string: 129 bits means an attacker must try 2^129 passwords on average to be sure of finding it.
How it works
Every password is built from cryptographic random values produced by the Web Crypto API, not from Math.random, whose output is predictable from a handful of observed values and must never be used for secrets.
Choose a length between 8 and 128 and which character sets to draw from. At least one character from each selected set is guaranteed to appear, and the result is shuffled afterwards so those characters do not always land in the same positions. Look-alike glyphs such as l, 1, I, O, and 0 can be excluded when the password will be read aloud or typed from a screen.
Each setting is scored in bits of entropy, which is the length multiplied by the bits contributed by each character of the alphabet. It describes how hard the settings are to guess, not the particular string on screen.
The password is generated in the page and never transmitted or stored. Reload and it is gone, so copy it straight into your password manager rather than leaving it on screen.
Frequently asked questions
- How long should a password be?
- For anything that matters, 16 characters or more with mixed sets. Length adds far more resistance to guessing than complexity rules do, which is why a longer password from a smaller alphabet usually beats a short cryptic one.
- Is a browser-generated password safe to use?
- Yes, when it comes from the Web Crypto API as it does here. That is the same source browsers use for cryptographic keys, and it is seeded by the operating system rather than by the clock.
- Which symbols can appear in the password?
- The set is !@#$%^&*()-_=+[]{};:,.?/ which is accepted by most services. Turn symbols off if a site rejects them, and add length to make up for the smaller alphabet: the entropy readout shows exactly what that trade costs.
- Is the generated password stored or logged?
- No. It exists only in the page while it is open. There is no server, no history, and no analytics event carrying the value, so closing the tab discards it for good.
- Should I reuse a generated password?
- No. Generate a separate one for every account so that a breach at one service cannot be replayed against another, and keep them in a password manager rather than trying to remember them.