Password Generator

How this random password generator works

This free password creator makes a strong password from the settings you pick. Choose a length and the kinds of characters to use, and the password generator builds a pool of allowed characters from your choices. It takes at least one character from every type you included, fills the rest of the password from the whole pool, and then shuffles the result so the guaranteed characters do not always come first.

Every pick uses your browser's cryptographic random number source rather than an ordinary pseudorandom function, and no character within a pick is favored over another. The password is generated on your device. It is not sent to a server, stored, or added to a shared link.

Password strength and entropy

Strength is estimated in bits of entropy: roughly the base-2 logarithm of the number of different passwords your settings could produce. With repeats allowed, the estimate is the password length multiplied by the base-2 logarithm of the pool size. A 16-character password drawn from 68 characters has 16 × log2(68) ≈ 97.4 bits. Each extra bit doubles the number of guesses an attacker needs.

When each character may be used only once, every position has one fewer character to choose from, so the entropy is slightly lower for the same length.

Length adds entropy faster than extra character types do. Going from 12 to 16 characters adds more strength than adding symbols to a 12-character password of letters and numbers.

Frequently asked questions

How long should a strong password be?

Aim for at least 15 characters. Current NIST guidance requires 15 or more for a password that is the only thing protecting an account, and recommends that sites accept at least 64. A longer random password costs nothing extra when a password manager remembers it.

Is it safe to use an online password generator?

This secure password generator creates the password inside your browser, so it never travels over the internet. For the best protection, use a different password for every account and keep them in a password manager.

What are look-alike characters, and should I skip them?

Characters such as l, I, O and 0 are easy to confuse when you read a password aloud or type it by hand. Skipping them makes the pool a little smaller, which lowers entropy slightly. Leave them in if you only ever paste the password.

Does using each character only once make a password stronger?

No. It removes some possible passwords, so entropy drops a little. Use it only when a site refuses repeated characters. It also limits the length to the number of characters in the pool.

Why does a shared link not show my password?

Putting a password in a link would expose it in browser history and anywhere the link is pasted. A shared link carries only the length and character options, and a new password is generated when it is opened.

Limitations

The entropy figure is an estimate for randomly generated passwords with these settings. Because every included character type is guaranteed to appear at least once, the true figure is slightly lower, most noticeably for very short passwords. It does not apply to a password you choose yourself, and it cannot account for a password that has been reused or exposed in a data breach. The strength ratings are this tool's own scale, not an industry standard.