Password Generator

How to use the password generator

1. Set the length, anywhere from 4 to 128 characters. For most accounts, 16 or more is a good choice.
2. Select the character sets to include: uppercase letters, lowercase letters, digits and symbols.
3. If you will ever have to read or type the password by hand, turn on exclude ambiguous characters to leave out look-alikes such as 0 O o 1 l I |.
4. Keep include at least one character from each set enabled if a website enforces composition rules.
5. Choose how many passwords to generate (up to 50), check the entropy estimate and strength label, then copy the one you want into your password manager.

How this tool generates passwords

Every character is picked using the browser’s cryptographically secure random number generator, crypto.getRandomValues, part of the Web Crypto API. Unlike Math.random(), it is designed so that its output cannot be predicted, even by someone who has seen earlier values.

Picking characters fairly is harder than it looks. The naive approach of taking a random number and computing it modulo the size of the character set introduces modulo bias: some characters come up slightly more often than others. This tool avoids modulo bias entirely, so every allowed character has exactly the same probability.

Everything happens on your device. The passwords are never sent over the network, never stored and never logged. Once you close or reload the page, they are gone.

Understanding the entropy estimate

Entropy, measured in bits, expresses how many guesses an attacker would need in the worst case. For a randomly generated password it is calculated as the length multiplied by log₂ of the number of possible characters. Each extra bit doubles the work for an attacker.

• A 12-character password using only lowercase letters (26 characters) has about 56 bits.
• A 16-character password using all four sets (roughly 90 or more characters) has about 104 bits.
• A 20-character password with the same sets exceeds 130 bits.

As a rough guide, anything below 50 bits is weak for an online account, 60 to 80 bits is reasonable, and 100 bits or more is very strong, even against offline cracking of a leaked password database. Excluding ambiguous characters shrinks the character pool slightly, so the estimate drops a little; add one or two characters to compensate. The estimate applies to passwords created here at random; it says nothing about passwords you invent yourself, which are usually far weaker than their length suggests.

Password advice that actually helps

• Length beats complexity. Adding characters raises entropy faster than adding symbol types. Current guidance, such as NIST SP 800-63B, emphasizes length and discourages arbitrary composition rules and forced periodic changes.
• Use a password manager. It can store a long, random, different password for every site, so you only have to remember one strong master passphrase.
• Never reuse passwords. When one site is breached, attackers try the same email and password everywhere else. Unique passwords stop that credential stuffing cold.
• Enable multi-factor authentication wherever possible, preferably with an authenticator app, a security key or a passkey rather than SMS.
• Change a password when there is a reason, for example after a breach, not on an arbitrary schedule.