Password generator

Build strong passwords by length and character type.

Length: 16

Uppercase A-Z Lowercase a-z Numbers 0-9 Symbols !@#$

Press Generate.

Passwords are generated only in your browser and never sent to a server.

A sign-up form is open and the temptation is to reuse the password you already remember. The problem is not that it is weak on its own - it is that one breach elsewhere hands an attacker the key to this account too. This generator makes a fresh random string on the spot, using your browser's cryptographic randomness, so nothing leaves the page.

How it works

How the password is made

The generator assembles a character pool from the boxes you tick, then draws each character using crypto.getRandomValues() - the browser's cryptographic random source. That is a different thing from the ordinary Math.random(), which is fine for shuffling a playlist but predictable enough to be a poor choice for secrets. All of it runs inside the page: there is no request carrying the result, and nothing is stored on a server.

The character sets

Option	Characters used	Count
Uppercase	A-Z without I and O	24
Lowercase	a-z without l and o	24
Numbers	2-9, with no 0 or 1	8
Symbols	`!@#$%^&*-_=+?`	13

Look-alike characters are left out deliberately, so a password that has to be read off a screen, dictated over the phone or typed into a TV remote does not turn into a support ticket.

Choosing a length

Length buys more security than exotic characters do. With the three default sets ticked, the pool is 56 characters, which works out roughly as:

8 characters - about 46 bits of entropy; too short for anything that matters
12 characters - about 70 bits; acceptable for low-value accounts
16 characters - about 93 bits; a sensible default
24 characters - about 139 bits; suited to a password manager, where you never type it

Adding symbols to a 16-character password moves it from roughly 93 to roughly 98 bits, a smaller gain than four extra letters would give. If a site refuses symbols, make the password longer instead of worrying about it.

Click the result to copy it, and keep it in a password manager rather than reusing it. A generated password is only as strong as where you store it. For accounts that really matter, turn on two-factor authentication as well - it protects you even if the password itself leaks.

Terms explained

Entropy: A measure of how unpredictable a password is, expressed in bits. Each extra bit doubles the number of guesses an attacker would need.
Character pool: The full set of characters any single position can be drawn from. Ticking more boxes widens the pool.
crypto.getRandomValues(): The browser API used here to produce cryptographically strong random numbers, rather than the predictable Math.random().
Look-alike characters: Glyphs that are easily confused in common fonts, such as I, l and 1, or O and 0. This generator omits them so passwords stay readable.

Frequently asked questions

Is it safe to generate a password on a website?

This page runs entirely in your browser: the characters are produced locally in JavaScript and never transmitted, so there is no request that could carry the password away. You can confirm that yourself by watching the network panel of your browser's developer tools while you generate one. On a shared or untrusted computer, though, your own password manager's generator is still the safer habit.

How long should my password be?

Sixteen characters is a reasonable default for most accounts. Go to 20 or more for email, banking and anything that can reset your other passwords, since those are the accounts an attacker wants most. Below about 12 characters, even a random password stops being meaningfully hard to crack with modern hardware.

Why are 0, 1, I, l and O missing from the output?

They are removed on purpose, because they look nearly identical in many fonts. Leaving them out prevents mistakes when you read a password off a screen, dictate it to someone or type it on a device without a proper keyboard. The trade-off is a slightly smaller character pool, which one or two extra characters of length more than makes up for.

Do symbols make a password much stronger?

Less than most people assume. Adding symbols to a 16-character password raises its entropy by roughly five bits, while adding four more letters adds around twenty-three. Length is the cheaper and more reliable lever, and it also sidesteps the sites that quietly reject certain punctuation marks.