Generate strong passwords at your choice of length and character sets — drawn from the browser's cryptographic random source, with the entropy shown in bits. Runs entirely in your browser — your numbers never leave this device.
Lowercase is always included.
| Length | Pool 26 — lowercase only | Pool 62 — letters + digits | Pool 82 — letters, digits + symbols |
|---|---|---|---|
| 8 | 37.6 bits | 47.6 bits | 50.9 bits |
| 10 | 47.0 bits | 59.5 bits | 63.6 bits |
| 12 | 56.4 bits | 71.5 bits | 76.3 bits |
| 16 | 75.2 bits | 95.3 bits | 101.7 bits |
| 20 | 94.0 bits | 119.1 bits | 127.2 bits |
Set a length, choose which character sets are in play, and the generator builds a password one character at a time. The randomness comes from the browser's cryptographic random source — the same crypto.getRandomValues facility that security code on the web is built on — and each character is picked by rejection sampling: random bytes are drawn, any byte that would bias the choice is discarded, and the rest map evenly onto the pool. That second detail is what separates a trustworthy generator from a plausible one, since a naive byte-modulo pick quietly favours the first characters of the pool. Predictable generators built on Math.random are the failure this page exists to avoid, and it never uses it.
The strength figure shown with each password is its entropy in bits — length times log2 of the pool size — printed in the table below for the common combinations. Entropy is the honest measure because it counts the whole search space an attacker must work through, and it exposes the two levers clearly: adding a character set raises the per-character value a little (a lowercase character carries 4.7 bits; one from a large mixed pool, about 6.4), while adding length adds that value again for every extra character. That is why the 16-character lowercase password in the table (75.2 bits) all but matches a 12-character one from the full mixed pool (76.3 bits) — and why length is usually the lever worth pulling. The optional exclude-ambiguous setting drops l, 1, I, O and 0 for passwords that must be read aloud or typed from paper, at a small, visible entropy cost.
Passphrase mode trades characters for words: it draws words at random from a built-in 96-word list, each word worth log2(96) ≈ 6.6 bits, joined by your separator, optionally capitalised and with a random number appended. Five words give about 32.9 bits before the number — easy to type and remember, but honestly weaker than a generated character password of the same screen width, so use more words for anything important. And the privacy rule is absolute here: passwords are generated in your browser, never uploaded, never stored, and never shown again once you close the tab — save the one you use in your password manager immediately.
For a generated password you store in a password manager, 16 characters is a sound default — even lowercase-only that is 75.2 bits, and with letters and digits it reaches 95.3 bits. Length beats cleverness: the table shows a 20-character lowercase password (94.0 bits) rivalling much shorter passwords from the full symbol pool. Whatever a site's maximum allows, use more length before more exotic sets.
It is the size of the search space, expressed as a power of two. A password with 75.2 bits of entropy is one of about 2^75 possibilities, and an attacker guessing must try half of them on average. Every extra bit doubles the work; ten extra bits multiply it by roughly a thousand. The figure assumes truly random generation — a password you invented by pattern has far less effective entropy than its length suggests.
Math.random is a general-purpose generator whose future and past outputs can be predicted from a sample of its results — fine for shuffling a playlist, disqualifying for secrets. This generator draws exclusively from crypto.getRandomValues, the browser's cryptographic random source, and uses rejection sampling so no character in the pool is favoured. Both choices are stated here because a password generator is exactly where they must not be taken on trust.
Only when a human will read or retype the password — read aloud over the phone, printed on a setup sheet, typed from one screen to another. Dropping l, 1, I, O and 0 removes the classic confusions at a modest entropy cost, which you can repay with one or two extra characters of length. For passwords that live in a manager and are only ever pasted, keep the full pool.
For the same strength, a generated character password is shorter on screen; a passphrase is easier to remember and type without a manager. The honest numbers: a 16-character letters-and-digits password carries 95.3 bits, while a five-word passphrase carries about 32.9 bits — passphrases need more words (eight or more) for important accounts, and they shine where you must type from memory, such as the master password itself.
No. Generation happens entirely in your browser — a generated password is never uploaded, stored, logged or tracked, and it cannot be shown again after you close the tab. That is deliberate: copy the password straight into your password manager or the account you are creating, because this page keeps no copy for you.
More in Everyday Tools & Generators · Browse all tools