Password Generator

How to create a strong password

1. Drag the length slider (6 to 64 characters). For anything that matters, start at 16 and go higher; the slider default is 16.
2. Tick the character types you want: uppercase, lowercase, numbers, symbols. Leave all four on unless the site you are signing up to refuses some symbols.
3. Click Generate password. Each click produces a brand-new password, so keep clicking until you have one you like.
4. Click Copy and paste it straight into the sign-up form and into your password manager. Do not retype it by hand.

What this generator actually does

The tool builds your password from the character sets you tick: 26 uppercase letters, 26 lowercase letters, the digits 0–9 and 24 symbols (! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . ? /). Every pick comes from crypto.getRandomValues, the browser's cryptographically secure random source, not Math.random. If a type is ticked, the password is guaranteed to contain at least one character of it, and the characters are then shuffled so the guaranteed ones do not always sit at the start. It does not add look-alike filtering, so characters such as O, 0, l and 1 can appear. If you will read the password aloud or type it from paper, expect to double-check those.

Reading the strength meter: the entropy math

The bar under the password estimates entropy in bits: length × log₂(pool size). Each extra bit doubles the number of guesses an attacker needs. With all four types ticked the pool is 86 characters, about 6.43 bits per character, so the default 16-character password is roughly 103 bits. Some reference points from the same formula:

• 16 characters, letters and digits only (pool of 62): about 95 bits.
• 16 characters, lowercase only (pool of 26): about 75 bits.
• 12 characters, all four types: about 77 bits.
• 8 characters, all four types: about 51 bits, which an offline attack on a fast, unsalted hash can still exhaust.

The labels are Weak below 45 bits, Fair below 70, Strong below 100 and Very strong above that. The figure is an estimate: it assumes an attacker knows nothing but the character pool, and the guaranteed-one-of-each rule slightly reduces the true number. For random output the difference is negligible. For a password you invented yourself the formula would badly overstate strength, which is why the meter only means something for generated passwords.

Common mistakes this avoids (and ones it cannot)

• Reusing one password. When one site leaks its database, attackers try the same email and password on other services (credential stuffing). A unique generated password per account confines the damage to one site.
• Predictable substitutions. Swapping a for @ in a dictionary word is in every cracking tool's rule set. Randomness beats cleverness.
• Keeping the password only in your head. A truly random 16-character string is not memorable. Store it in a password manager and memorize just one long master passphrase.
• Rejected symbols. Some sites cap length or ban certain symbols. If a form rejects the password, untick Symbols and raise the length by four or five characters to compensate.
• Phishing. No password, however strong, protects you from typing it into a fake login page. Turn on two-factor authentication where offered.

Which length to pick

Email, banking and your password manager's master password deserve 20 or more characters. Ordinary accounts are well served by 16. Wi-Fi keys that you must type on a TV or console can be 20 letters and digits, since symbols are awkward on on-screen keyboards. Very short outputs (6 to 8 characters) are offered only because some legacy systems demand them; treat them as weak.

Is it private and safe?

Yes. Passwords are produced by JavaScript on your own device. There is no server request involved, no cookie that stores the result and no history. When you close or refresh the tab, the password is gone, so copy it first.

Related guides: How long should a password be?, How to create a strong password, Are online password generators safe? and How to share a password safely.