Password Generator

A strong password generator that never sees your passwords

The Password Generator creates truly random passwords from 4 to 128 characters using your browser’s cryptographic random number generator (crypto.getRandomValues). Choose uppercase and lowercase letters, digits and symbols, avoid look-alike characters such as l and 1, block characters a website refuses, and make up to 50 passwords at once.

Every password is created on your own device and is never uploaded, logged or saved; only your settings are remembered. Each result shows its entropy in bits, a plain-language strength rating and how long a well-equipped attacker would need to try every possibility.

Use it for new accounts, Wi-Fi keys, database users or test accounts. If you need something you can remember and type easily, the Passphrase Generator builds memorable word-based passwords instead.

How to use the Password Generator

1. Choose a style: “Random characters” for maximum strength per character, or “Pronounceable” for passwords that are easier to read out and type.
2. Set the length with the slider or type a number from 4 to 128. Sixteen or more random characters is a good default for important accounts.
3. Tick the character sets you want, and optionally “Avoid look-alikes” or list characters to leave out in “Never use these characters”.
4. Enter how many passwords you need (1–50). The list updates instantly whenever you change a setting.
5. Press “Copy” next to a password, or “Copy all” to copy the whole list. Press “Generate new” for a fresh batch.

Password Generator features

How password entropy is calculated

Entropy measures how many guesses a random password could require, expressed in bits: each extra bit doubles the number of possibilities. For a password of length L where every character is chosen uniformly from a pool of N characters, entropy = L × log₂(N).

Worked example: 16 characters from the full pool of 26 + 26 + 10 + 28 = 90 characters gives 16 × log₂(90) ≈ 103.9 bits. Requiring at least one character from each of the four sets removes the passwords that skip a set, which lowers the total only slightly — the tool counts these exactly with the inclusion–exclusion principle and shows about 103.6 bits.

Pronounceable passwords pick each position from a smaller set (18 consonants or 5 vowels), so 12 pronounceable letters carry about 39 bits, while 12 fully random characters carry about 78. Longer is the easy fix.

What the crack-time estimate assumes

The estimate assumes the worst realistic case for you: an attacker has stolen a database of password hashes made with a fast, unsalted or lightly salted algorithm (such as MD5, SHA-1 or NTLM) and tests 10¹⁰ (ten billion) guesses per second on GPU hardware. The time shown is how long it takes to try every possible password; on average the right one is found halfway through.

Sites that store passwords properly with bcrypt, scrypt or Argon2 slow attackers down by many orders of magnitude, and online login forms are slower still because of rate limits. The estimate is only valid for passwords made randomly by a tool like this one — a password you invent yourself is usually far weaker than its length suggests. You can check one with the Password Strength Checker.

Password advice that matches current guidance

• Length beats complexity. NIST SP 800-63B recommends allowing long passwords and not forcing composition rules; a longer password adds more strength than swapping letters for symbols.
• Use a unique password for every account so one breach cannot unlock the others. A password manager makes this practical.
• Do not rotate passwords on a schedule. Current guidance says to change a password only when there is evidence it has been compromised.
• Turn on two-factor authentication for email, banking and anything that can reset other accounts.
• Avoid sending passwords over chat or email. If you must share a secret, encrypt it first with Text Encryption and share the key separately.