Password Generator
Understand Password Generator
Generates a random password of a chosen length from the character sets you enable, using the browser cryptographic random number generator.
How it works
Every character is drawn from crypto.getRandomValues, the platform CSPRNG, rather than Math.random, whose internal state can be recovered from a short run of outputs and its future values predicted. Strength is entropy, and entropy is log2(alphabet size) bits per character: 16 characters over the 62 mixed-case alphanumerics is about 95 bits, and adding the symbol set takes the same length to roughly 103 bits. Length buys more than variety — 20 alphanumeric characters (about 119 bits) beats 16 characters with symbols.
When to use it
- Creating a database, service account, or admin credential that no human will ever type from memory.
- Rotating a password or API secret after a leak or a departure.
- Generating a value you will paste straight into a password manager or a secrets store.
- Turning symbols off for a system whose validator rejects them, rather than fighting the form.
- Using no-ambiguous mode for a credential someone has to read off a screen or dictate.
Watch out for
- Character-type rules are not enforced. Each position is drawn independently, so a password can legitimately come out with no digit even when digits are enabled — sites with "must contain a number" rules will reject it. Generate another one rather than editing it by hand.
- The strength label is a coarse heuristic over length and which sets are on. It is not an entropy measurement, and it cannot say anything about a password you did not generate here.
- Excluding ambiguous characters (0, O, o, I, l, 1) removes six symbols from the pool. That costs only about 2% of the entropy per character, which is a fair trade when a human must transcribe the value — but do not pay it on top of a short length.
- A password is only as safe as where it goes next. Clipboard managers, chat windows, and shell history keep copies. Move it straight into a password manager and do not park it in a scratch file.
Not the right tool for: A password you have to memorize. For a master password or a disk passphrase, four or five random words are far easier to recall and reach comparable strength through length.
Frequently Asked Questions
What is a strong password?
A strong password is at least 16 characters long, randomly generated, and uses a mix of uppercase letters, lowercase letters, digits, and symbols. It should not be a dictionary word, name, or date. This generator creates passwords meeting all these criteria using crypto.getRandomValues().
What makes a strong password?
Strength comes from entropy — how hard it is to guess. Length matters most: each added character multiplies the search space. Random generation beats human-chosen patterns (sports teams, birthdays, keyboard walks). A 16-character random password with mixed character types is effectively unguessable.
How to create a strong password that I can remember?
Use a passphrase instead: 4–5 random words joined by a separator (correct-horse-battery-staple). A 5-word passphrase has ~65 bits of entropy and is far easier to memorize than a random string. Alternatively, use a password manager — it remembers the random password for you.
How to Use Password Generator
- Paste or type your input in the input area above.
- The tool processes your input automatically or click Run.
- Copy or download the result using the action buttons.
- Use Ctrl+Enter to run quickly from the keyboard.