Free · in-browser · nothing transmitted
Password Generator
Generate strong random passwords using your browser's cryptographic random source — the password is created on your device and never sent, stored, or logged anywhere. Choose length and character types, or switch to a memorable word passphrase.
Short answer
A strong password is truly random and long— a 16-character random password over the full character set carries ~100 bits of entropy, beyond any realistic attack. This generator draws from your browser's cryptographic random source, entirely on your device: no password is ever transmitted, stored, or logged. Generate below, copy into your password manager, done.
Pool: 85 characters · entropy = length × log2(pool)
Generated on your device with cryptographic randomness — never sent, stored, or logged.
Common lengths and the passphrase mode
Password strength by length (entropy bits)
| Length | Letters + digits | All characters | Rating (all chars) |
|---|---|---|---|
| 8 characters | 48 bits | 51 bits | Fair |
| 10 characters | 60 bits | 64 bits | Strong |
| 12 characters | 72 bits | 77 bits | Strong |
| 14 characters | 83 bits | 90 bits | Very strong |
| 16 characters | 95 bits | 103 bits | Very strong |
| 20 characters | 119 bits | 128 bits | Very strong |
| 24 characters | 143 bits | 154 bits | Very strong |
| 32 characters | 191 bits | 205 bits | Very strong |
Entropy = length × log2(character-pool size); each +10 bits multiplies the guessing work ~1,000×. Ratings assume a truly random password — human-chosen ones are far weaker at the same length.
Why in-browser generation matters
A password's security starts with who has seen it — and the only right answer is nobody. Everything here happens in your browser's own cryptographic random generator: open your network tab and generate as many as you like; no request carries them anywhere. Pair that with the two habits that do the heavy lifting — a password manager holding a unique random password per site, and a memorable passphrase guarding the manager itself — and a leaked database at one service stops being a threat to the rest of your life.
How we calculate this
How the generator works, and why the details matter:
- Cryptographic randomness. characters are drawn with crypto.getRandomValues using rejection sampling — the browser's CSPRNG, with the modulo bias removed. Math.random() is never used.
- Class guarantee. one character from every selected type is placed first, the rest drawn from the full pool, then the order is shuffled (Fisher–Yates) — so 'must contain a digit' rules always pass without weakening randomness.
- Strength (entropy). bits = length × log2(pool size). 16 characters over the full pool is ~100+ bits — far beyond any online guessing attack; passphrases add 8 bits per word from a 256-word list.
Assumptions
- Generation happens entirely in your browser: no network request carries the password, nothing is stored, and reloading the page destroys it.
- Entropy ratings assume the attacker knows the generator's rules but not the random draws — the standard (Kerckhoffs) assumption.
- Some sites cap length or ban symbols; the options exist to fit their rules, and the table shows what each restriction costs in bits.
- A password manager is assumed as the storage strategy — these passwords are not designed to be memorized (that's what the passphrase mode is for).
Sources
Last reviewed: July 22, 2026
Frequently asked questions
Is it safe to use an online password generator?+
It depends entirely on where the password is made. This one is generated inside your own browser using crypto.getRandomValues — the page makes no network request with the password, nothing is stored or logged, and reloading destroys it. You can verify that in your browser's network tab: generating produces zero requests. A generator that creates passwords on a server, by contrast, has seen every password it ever made.
How long should a password be?+
For anything stored in a password manager: 16+ characters with all character types (~100 bits of entropy) — beyond realistic attack. 12–14 characters is a reasonable floor for accounts with lockout protection. Below 10, offline cracking gets cheap: an 8-character password, even fully random, falls to serious hardware in days. Length beats complexity — each extra character multiplies the attacker's work by the whole pool size.
What makes a password strong?+
Genuine randomness, then length. Strength is measured in entropy bits — length × log2(pool size) — and only holds if every character is truly random. Human patterns (words, dates, keyboard walks, 'P@ssw0rd1!' substitutions) collapse the real search space by orders of magnitude, which is why cracking tools try them first. A random 12-character password beats a clever-looking 20-character one built from words and birthdays.
Password or passphrase — which should I use?+
Both, for different jobs. Random character passwords are for everything your password manager fills automatically — memorability is irrelevant there. A passphrase (several truly random words) is for the handful of secrets you must type or remember: the manager's master password, disk encryption, your computer login. From this tool's 256-word list, 8 random words give ~64 bits — strong, and vastly easier to type than 11 random symbols.
Should I avoid ambiguous characters like l, 1, O and 0?+
Only when a human will read or type the password off a screen or paper — the 'avoid ambiguous' option removes Il1O0 so transcription can't go wrong. It costs a little entropy (a slightly smaller pool), which the strength meter reflects honestly. For passwords that only ever live in a manager and autofill, leave every character in.
How should I store the passwords I generate?+
In a password manager — that is the assumption this whole tool is built on. A manager lets every account have a unique random password, which turns a site breach from a catastrophe into a non-event, and its autofill also protects against phishing look-alike domains. Protect the manager itself with a strong passphrase and two-factor authentication, and let it hold everything else.
Passwords are generated with crypto.getRandomValues on your device and exist only on this page until you leave it. Nothing you generate or type is transmitted.