Password generator
Create random passwords with deliberate length and character controls, multiple outputs, and local copy or download.
How it works & useful details
How to use this tool
Choose the length and character groups, then generate passwords. Each password includes every selected group.
Details and limits
Uses Web Crypto rejection sampling to avoid modulo bias, and samples whole candidates until all selected groups occur. No passwords are generated on page load. Length 4–256, count 1–50. This tool makes no password-strength score or guarantee.
Passwords stay in page memory until you choose to copy or download them. Copying uses your system clipboard; downloaded files contain plaintext. Use unique passwords and store them in your password manager.
About this tool
Password generator creates random passwords with explicit length and character-set controls and produces several outputs at once so you can choose a strong one. Generation uses your browser’s cryptographic random source.
Nothing is generated on a server, and results are not logged. If you download or paste a generated password elsewhere, treat that destination as part of your security boundary.
How to use it
- Choose the length and which character groups to include or exclude.
- Exclude ambiguous characters if the password will be typed by hand.
- Generate the batch and pick a result.
- Copy or download it and store it in your password manager immediately.
How strong is the result?
With all four groups selected, each character is drawn from 85 possibilities: 26 lowercase letters, 26 uppercase letters, 10 digits, and 23 symbols. Every character adds about 6.4 bits of entropy:
- 12 characters ≈ 77 bits
- 16 characters ≈ 102 bits
- 20 characters (the default) ≈ 128 bits
- 32 characters ≈ 205 bits
Around 80 bits is out of reach of offline guessing for the foreseeable future, and 128 bits is comparable to a strong encryption key. Requiring every selected group removes a tiny fraction of possible strings, which lowers these figures negligibly. Length adds more strength than extra symbol types do: a 20-character password with letters and digits only (≈ 119 bits) beats a 14-character password with all groups (≈ 90 bits).
Practical advice
- Use a different password for every account, and keep them in a password manager.
- Turn on "exclude ambiguous characters" (I, l, 1, O, 0, o) for passwords that someone must read aloud or type from paper.
- If a site rejects some symbols, turn symbols off and add length instead.
- Enable two-factor authentication where possible. A strong password does not protect you against phishing.
Passwords are generated with the browser's cryptographic random source, using rejection sampling so that no character is more likely than another. They are never generated automatically on page load, stored, or sent anywhere.
Frequently asked questions
How random are these passwords?
They use the Web Crypto random source in your browser, which is suitable for credentials when the length and character set are adequate.
Should I avoid ambiguous characters?
Excluding characters like l, 1, O, and 0 reduces typing mistakes without meaningfully weakening a sufficiently long password.
Is generated output stored anywhere?
No. Passwords exist only in the page until you copy or download them.
Should I use a passphrase instead?
Passphrases of several random words are easier to type and remember, which suits a password manager's master password. For everything stored in a manager, a long random password like this one is simplest.