How to use the password generator
- 1A password is ready when the page loads. Press Copy to use it, or Regenerate for another.
- 2Set the Length with the slider or the number box, and choose which Characters to include.
- 3Tick Exclude look-alike characters if the password will be read or typed by hand.
- 4For something memorable, switch Type to Passphrase and choose the number of Words and a Separator.
Defaults (one run)
Password · 16 characters · all four character sets Passphrase · 6 words · hyphen
q91RB_9$p-)StUD5 (90 characters, 103.9 bits) jigsaw-cliff-polar-waffle-fig-hermit (1,451 words, 63.0 bits)
Each press of Regenerate gives a different result; these are one real run.
Length vs complexity
Strength comes from the number of possible passwords, measured in bits of entropy: length × log₂(characters to choose from).
| Password | Bits |
|---|---|
| 8 characters, lowercase only | 37.6 |
| 8 characters, all 94 printable ASCII | 52.4 |
| 12 characters, letters and digits | 71.5 |
| 16 characters, letters and digits | 95.3 |
| 16 characters, all four sets here (90) | 103.9 |
Adding length beats adding symbols: four extra letters-and-digits characters add 23.8 bits, while widening an 8-character letters-and-digits password to all 94 printable characters adds only 4.8. NIST SP 800-63B now asks services to require at least 15 characters when a password is the only sign-in factor.
Passphrases
A passphrase strings random words together, such as jigsaw-cliff-polar-waffle-fig-hermit. Each word drawn from this generator's list of 1,451 common words adds 10.5 bits, so:
- 4 words ≈ 42 bits: too weak for anything important.
- 5 words ≈ 52.5 bits.
- 6 words ≈ 63 bits: a good choice for a password manager's master password or a device you type into often.
The words must be chosen randomly, as here; a phrase you think up yourself is far easier to guess. Capitalize each word adds no strength because attackers try it; Add a number adds about 5.9 bits for six words.
Excluding look-alike characters
Exclude look-alike characters removes I l 1 | O 0 o, which are easy to confuse in many fonts. Use it for passwords that will be read aloud, printed, or typed from a phone screen, such as Wi-Fi keys. It shrinks the pool from 90 to 83 characters, so a 16-character password drops from 103.9 to 102.0 bits: add a character if that matters to you.
If a site rejects certain symbols, untick Symbols and add three or four characters of length instead.
How the passwords are generated (Web Crypto)
Characters are picked with crypto.getRandomValues, the browser's cryptographically secure random number generator, never Math.random. Each pick uses rejection sampling, so every character in the pool is exactly equally likely (no modulo bias). With Use every selected type at least once, passwords missing a selected type are discarded and drawn again, which keeps the result uniform among passwords that meet the rule.
Generation happens on your device. Passwords aren't saved in your browser, sent to our server or logged; only your option choices (length, sets) are remembered.
Storing passwords safely
Use a different password for every account, and keep them in a password manager (built into most browsers and phones, or a dedicated app) rather than a document or notes app. Then you need to remember only one strong passphrase.
Turn on two-step verification or passkeys where offered. NIST's guidance is to change a password when there's evidence it was compromised, not on a schedule. Check whether an email address appears in known breaches with a service such as Have I Been Pwned.
Is anything I enter stored?
This tool runs entirely in your browser. Your text is not uploaded to our servers.