Password Generator
Create strong random passwords with your own length, character types and rules — generated in your browser.
Strength: – · 0 bits of entropy · pool of 0 characters
How it works
Choose a length, tick the character types you want, and a fresh password appears
immediately — every change to a slider or checkbox regenerates it. The random values come
from crypto.getRandomValues(), the browser's cryptographically secure random
number generator, and each index is drawn with rejection sampling so no character is even
slightly more likely than another. Math.random() is never used. The generator
also guarantees at least one character from every type you selected, then shuffles the
result, so a password with numbers and symbols enabled really contains them instead of
leaving it to luck.
The strength readout is measured in bits of entropy: length multiplied by the base-2 logarithm of your character pool (or the permutation count when "no repeated characters" is on). Roughly speaking, under 36 bits is weak, 60 bits is acceptable for a low-value login, 80 bits or more is strong, and 128 bits is overkill in the good way. Length beats complexity — going from 12 to 20 lowercase letters adds far more entropy than sprinkling in a symbol. Turn on "exclude look-alikes" when the password has to be typed or read aloud.
Nothing here touches a network. The page has no ads, no analytics on your input and no server call, so the password exists only in this tab until you copy it, and it works offline once the page has loaded. Generate up to 50 at once and download them as a plain text file if you are setting up a batch of accounts.
Frequently asked questions
Is this online password generator safe to use?
Yes. The password is created entirely in your browser with the Web Crypto API and is never sent anywhere — there is no server call, no logging and no analytics on the output. The page even keeps working offline once loaded, so you can disconnect first if you want to be certain. That is not true of generators that build the password on a server: a secret produced on someone else's machine has already left your control.
How long should a strong password be?
Aim for at least 16 characters for anything that matters, and 20 or more for email, banking and password-manager master passwords. Length beats complexity: 20 lowercase letters is about 94 bits of entropy, while a 10-character password using all four character types is only about 64 bits. Use the entropy readout on this page as your guide — 80 bits or more is strong, and 128 bits is future-proof.
Are the passwords really random?
They come from crypto.getRandomValues(), your browser's cryptographically secure random number generator, not from Math.random(). Each character index is drawn with rejection sampling so every character in the pool is exactly equally likely, and the final password is shuffled with a Fisher-Yates shuffle using the same random source. Nothing is derived from the time, your device or any seed you could reproduce.