Password Generator

How this generator works

Passwords here are built using your browser's cryptographically secure random number generator (crypto.getRandomValues), which is the same class of randomness used for encryption keys. This matters more than it sounds: many simple generators use Math.random(), which is fast but predictable enough that an attacker who knows a little about when a password was generated can narrow the possibilities dramatically. It is not suitable for anything security-related.

The generator also avoids a subtle flaw called modulo bias, where a naive mapping from random numbers to characters makes some characters slightly more likely than others. Over many passwords, that bias measurably shrinks the search space an attacker has to cover.

Choosing a length

Length does more for password strength than complexity rules do. Each additional character multiplies the number of possible combinations, so a longer password from a smaller character set often beats a short one packed with symbols.

As a rough guide: 12 characters is a reasonable minimum for most accounts, 16 is a good default, and 20 or more is sensible for anything high-value like email, banking, or a password manager's master password. If a site imposes a maximum length, use the maximum it allows.

What the strength indicator means

The strength shown is measured in bits of entropy, calculated from the length of your password and the size of the character set it was drawn from. Because these passwords are genuinely random, entropy is an honest measure — unlike strength meters that guess at human-chosen passwords by checking dictionaries and common patterns.

Each extra bit doubles the number of possibilities an attacker must try. Around 60 bits is reasonable for everyday accounts; 80 bits or more is comfortable for high-value ones. Adding characters raises entropy faster than adding character types does.

Excluding ambiguous characters

The "exclude ambiguous characters" option removes characters that are easy to misread: zero and capital O, lowercase L, capital I, the digit one, and the pipe symbol. This is useful when a password will be read off a screen and typed by hand, written down temporarily, or read aloud.

It comes at a small cost: a smaller character set means slightly less entropy per character. If you enable it, consider adding two or three characters to the length to compensate. The strength indicator updates to reflect the real character set, so you can see the trade-off.

Is it safe to generate passwords on a website?

It depends entirely on where the generation happens. A password generated on a server and sent to your browser has, by definition, existed somewhere other than your device — and you have no way to verify what happened to it.

This generator runs entirely in your browser. There is no server call at any point, and nothing is stored — no history, no local storage, no logging. You can confirm this yourself: open your browser's developer tools, go to the Network tab, and generate a few passwords. You will see no requests.

For maximum peace of mind on high-value accounts, a dedicated password manager that generates and stores passwords locally is still the best practice — it removes the need to copy a password between applications at all.

Good practice beyond generating

A strong password only helps if it's used well.

• Use a different password for every account. Reuse is the single most common way accounts get compromised — one breached site exposes every account sharing that password.
• Use a password manager. Remembering unique long random passwords isn't realistic; a manager makes it practical.
• Turn on two-factor authentication wherever it's offered. It protects you even if a password is exposed.
• Change a password if you suspect exposure, not on an arbitrary schedule. Forced rotation tends to push people toward weaker, patterned passwords.

Frequently asked questions

Are these passwords sent to a server?

No. They're generated in your browser and never leave your device. Nothing is stored or logged.

What randomness does it use?

Your browser's crypto.getRandomValues, a cryptographically secure random source — not Math.random().

Can the same password be generated twice?

It's theoretically possible but vanishingly unlikely at reasonable lengths. A 16-character password from the full character set has far more combinations than could realistically collide.

Why exclude ambiguous characters?

So the password is easier to read and type accurately. It slightly reduces entropy, so consider a couple of extra characters if you enable it.

How long should my password be?

16 characters is a good default. Use 20 or more for email, banking, and password manager master passwords.

Is it free?

Yes, completely free with no sign-up.