Password Generator
Truly random, generated on your device.
- Files stay on your device
- No upload, no waiting
- No sign-up, no watermark
Related tools
All generatorsQuestions
How long should my password be?
Sixteen characters using all four character sets gives about 105 bits of entropy, which is beyond any realistic offline attack. Twelve gives about 79 bits — around a decade of cracking — and eight gives about 52 bits, which falls in under a minute. Length matters far more than complexity because it sits in the exponent of the search space, so adding characters beats adding symbol types.
Is this password generator actually safe to use?
Every character is drawn from crypto.getRandomValues, the browser's cryptographically secure random source, never Math.random — whose internal state can be reconstructed from a few outputs. Generation happens entirely on your device and nothing is transmitted, logged or stored. You can disconnect from the internet after the page loads and it still works, which is the only real way to verify a generator is not keeping a copy.
Why avoid look-alike characters?
Capital I, lowercase l and the digit 1 are near-identical in many fonts, as are capital O and zero. If a password will ever be read off a screen, printed, or dictated over the phone, excluding them prevents a lot of failed logins. It costs a few bits of entropy, so add a character or two of length to compensate. Skip the option for passwords that only ever live in a password manager.
What does the crack time estimate assume?
An offline attack at roughly a trillion guesses per second, which is realistic for someone with modern GPUs and a stolen password database, and it halves the search space because the average find is at the midpoint. Against a properly configured slow hash like bcrypt or Argon2 the real time is many orders of magnitude longer — but never assume the site you signed up to did that correctly.
Should I use a passphrase instead?
For the handful of passwords you must actually memorise — your password manager, your device login — yes. Five or six random words are easier to remember and stronger than most twelve-character symbol soup. For everything else, use a password manager and let each password be long and random; you should not know any of them.
About password generator
Length beats complexity
The old advice — one uppercase, one number, one symbol — produces passwords that are hard for humans and easy for computers. What actually decides how long a password survives is the size of the search space, which is the character pool raised to the power of the length. Length is in the exponent. Adding one character to a 26-symbol pool multiplies the work by 26; adding symbols to a fixed length only widens the base.
| Password | Entropy | Offline crack time |
|---|---|---|
| 8 chars, all four sets | ~52 bits | Under a minute |
| 12 chars, all four sets | ~79 bits | Around a decade |
| 16 chars, all four sets | ~105 bits | Longer than the universe has existed |
| 20 chars, all four sets | ~131 bits | Effectively unbreakable |
Those times assume an offline attack at about a trillion guesses per second against a fast hash — a realistic figure for someone with modern GPUs and a stolen password database. Against a properly configured slow hash such as bcrypt or Argon2 they are many orders of magnitude longer, but you should never assume the site you signed up to did that properly.
Why this uses crypto.getRandomValues
Every character here is drawn from crypto.getRandomValues, the browser’s cryptographically secure random source, never Math.random. Math.random is a fast non-cryptographic generator whose internal state can be reconstructed from a handful of outputs — perfectly fine for shuffling a list, completely unacceptable for anything guarding an account.
There is a subtler detail. Taking a random 32-bit number modulo the pool size is biased toward low values whenever the pool does not divide evenly into 2³², which quietly makes some characters more likely than others and shrinks the real search space. This generator uses rejection sampling to avoid that, so every character is genuinely uniform.
The look-alike option
Switching on “Avoid look-alikes” removes characters that are easy to confuse when read from a screen, printed on paper or dictated over the phone: capital I, lowercase l and the digit 1; capital O and zero; and quotes and punctuation that are easy to mistype. It costs a few bits of entropy, which you should give back by adding a character or two of length. Worth it for a Wi-Fi password on a fridge door; pointless for something that lives only in a password manager.
Practical advice
- Use a password manager and let every password be long and random. You should not know any of your passwords except the one that unlocks the manager.
- For the passwords you must memorise — your manager, your device login — use a passphrase of five or six random words. It is easier to remember and stronger than most 12-character symbol soup.
- Never reuse a password. Credential stuffing — replaying leaked pairs against other sites — is how most account takeovers actually happen, and no amount of complexity helps against it.
- Turn on two-factor authentication wherever it is offered. It defeats an attacker who already has your password.
Nothing generated here is transmitted, logged or stored. The generation happens in your browser using your device’s own entropy source, and the page keeps working with the network disconnected — which is the only real way to be sure a password generator is not keeping a copy.
Related
Browse the rest of the generators, or create identifiers with the UUID generator.