A password generator that uses real randomness
This password generator builds each password from the character sets you select, using the Web Crypto API (crypto.getRandomValues) with rejection sampling so every character is equally likely. Humans are bad at inventing random strings; we reuse words, dates and keyboard patterns that password-cracking tools try first. A generated password avoids those patterns completely.
At least one character from every set you tick is guaranteed, and the result is shuffled afterwards, so the required characters do not always appear in the same positions.
What makes a password strong?
Strength is measured in bits of entropy: the number of guesses an attacker needs, written as a power of two. For a random password it is simply length × log2(pool size).
| Character sets | Pool size | Bits per character | 12 chars | 16 chars | 20 chars |
|---|---|---|---|---|---|
| Digits only | 10 | 3.3 | 40 | 53 | 66 |
| Lowercase + digits | 36 | 5.2 | 62 | 83 | 103 |
| Upper + lower + digits | 62 | 5.95 | 71 | 95 | 119 |
| All four sets | 89 | 6.48 | 78 | 104 | 130 |
The tool shows the estimated entropy for your settings. Around 80 bits is strong for an online account that is also protected by rate limiting; 100 bits or more is appropriate for anything that could be attacked offline, such as an encrypted archive. Notice that adding length raises entropy faster than adding symbols.
Options explained
- Length (4–128) – longer is always stronger. Very short lengths are allowed for testing input validation, not for real accounts.
- Uppercase, lowercase, digits, symbols – match the rules of the site you are signing up for. The symbol set is
!@#$%^&*()-_=+[]{};:,.<>?/~. - Exclude look-alikes – removes characters that are easy to confuse:
i,l,L,1,o,Oand0. Use it for Wi-Fi keys or codes you will read aloud; it slightly reduces the pool size. - Exclude ambiguous symbols – drops the brackets and punctuation
( ) [ ] { } ; : , . < > / ~that some sites reject or that are easy to misread; the entropy estimate takes the smaller symbol set into account. - How many – create up to 100 passwords at once, useful when provisioning test accounts.
Example output
k7#Vq!n2Rf@x9Lp_
T3m$wZ8e]bQ4&hYc
u9=Pa2!Gd7^sKx5vEvery run produces new values; nothing is cached between clicks.
Common mistakes the generator helps you avoid
Attackers rarely guess passwords one character at a time. They use lists of leaked passwords, dictionary words with common substitutions (p@ssw0rd), keyboard walks (qwerty123), names followed by years and the same password reused across sites. A generated password contains none of these patterns, so the only way to find it is brute force, which is exactly what the entropy figure measures.
Another frequent mistake is making a strong password and then storing it somewhere weak: a sticky note, an unencrypted spreadsheet or a chat message. Paste the result directly into a password manager, and avoid sending it by email. If you must share a password with a colleague, use your manager's sharing feature.
Good password habits
- Use a different password for every account, and store them in a password manager rather than a text file.
- Turn on two-factor authentication where it is offered; it protects you even if a password leaks.
- For a password you must memorize, such as the master password of your manager, a passphrase from the memorable password generator is easier to remember at similar strength.
For developers
If you are building a sign-up form, never store passwords in plain text. Hash them with a slow algorithm; you can experiment with the bcrypt generator to see what stored hashes look like. For API keys and tokens rather than human passwords, the random string generator offers URL-safe and hex alphabets.