webtools

Password Generator

Private: generated on your device, never sent anywhere

New password every change

Strong random passwords from your browser's own cryptographic random number generator. Set the length, choose the character types, and see honestly how long the result would take to crack.

About this password generator

Every password here comes from the Web Crypto API, the same cryptographic source a browser uses for its own key material. There is no seed based on the clock, no shuffling of a phrase, and no server: the password exists only on this page until you copy it. Reload and it is gone.

Two details matter more than most generators admit. The picking is rejection sampled, so every character in the pool is exactly as likely as every other one, rather than the first few being slightly favoured by a careless remainder. And the result always contains at least one character from each type you switched on, so a password never gets rejected by the form you made it for.

The strength figures are arithmetic, not a verdict, and it is worth knowing which. Entropy here is the length multiplied by the base two logarithm of the pool size, which is the correct number for a string picked uniformly at random and for nothing else: it is honest precisely because you did not choose these characters. The crack time then divides half of that keyspace by ten billion guesses a second, a rate an offline attacker can rent today against a fast hash. Read it as a way of comparing one length against another, not as a promise of years. A site that stores your password with bcrypt or Argon2 slows that attacker by orders of magnitude; a site that rate limits its login form makes the figure irrelevant; a site that leaks the password in plain text makes it irrelevant the other way. Reuse, phishing and malware never appear in the arithmetic, and they are how most passwords are actually lost. If what you need is a value that must be unique rather than secret, a UUID is the better tool.

How to generate a strong password

  1. Drag the Length slider. Longer beats clever: length adds more strength than any single symbol.
  2. Switch character types on or off. Every change generates a fresh password.
  3. Tick Skip look alike characters if you will have to type it by hand or read it aloud.
  4. Check the strength bar. Aim for Strong or better, which is 60 bits and up.
  5. Press Copy, then paste it straight into your password manager.

Common questions about password strength

Is the password sent to a server?
No. It is generated by JavaScript on this page using your browser's own random number generator. Nothing is uploaded, logged or stored, and the page keeps working with your connection switched off. Once you close the tab the password is gone, so save it somewhere before you leave.

Is this random enough to trust?
It uses crypto.getRandomValues, which is seeded by the operating system and designed for cryptographic use. It is not Math.random, which is fast but predictable and must never be used for a secret. Characters are drawn with rejection sampling so the distribution stays even.

What do the bits of entropy mean?
Each bit doubles the number of guesses an attacker has to make. A 20 character password drawn from all 86 characters here is 129 bits, which is out of reach of any hardware that exists. Under 40 bits is crackable on one machine in minutes, so treat it as weak no matter how odd the characters look.

How long should a password be?
Sixteen characters or more for anything that matters, and different for every site. The real risk is reuse: one breached site then opens all the others. A password manager holding long random passwords like these, behind one long passphrase you remember, is the arrangement to aim for.

Why skip look alike characters?
Because a lowercase l, the digit 1, a capital I, a capital O and a zero are hard to tell apart in many fonts. If the password will be typed by hand, read out over the phone or printed, leaving them out saves the confusion. It takes the pool from 86 characters to 81, which at the default length of 20 costs two bits: one extra character gives back more than three times that.

Next

Related tools

All Generators
UUID Generator Generate v4 UUIDs one at a time or a thousand at once. Hash Generator MD5, SHA-1, SHA-256 and SHA-512 checksums of text or files. Random Data Generator Fake names, emails and rows of test data as JSON or CSV. QR Code Generator QR codes for links, text, WiFi or contact cards. PNG or SVG.