Password Generator

About Password Generator

Every character comes from crypto.getRandomValues, the browser's cryptographically secure generator — never Math.random, whose output is predictable from a handful of samples. Length, character classes and whether ambiguous characters are allowed back in are all yours to set.

Each switch names the characters it brings: a–z, A–Z, 2–9, the symbol set in full, and the look-alikes i l I O 0 1 o that are held back by default so a password survives being read aloud. The result lists them again, character by character, so the pool is never a number you have to take on trust.

The entropy estimate is the number that matters, and the coloured meter is there to read it at a glance rather than to replace it. It tells you how many random bits the password actually carries: a 20-character password from the default 57-character alphabet carries about 117 bits, which no offline attack will exhaust. The guessing time beside it assumes an attacker holding the hash and trying a million million passwords a second — a yardstick, not a promise.

Where it helps

• Cryptographically secure randomness, generated locally and never transmitted.
• Generates a batch at once, so you can pick one and discard the rest.
• Reports entropy in bits, with a coloured meter and a guessing time for what those bits are worth.
• Names every character it can draw from, so "symbols" is never left to the imagination.
• Ambiguous characters such as l, 1, I, O and 0 are left out by default, so a password survives being read aloud or retyped.

Limits

• Generated passwords are not stored anywhere — once you navigate away they are gone, so save the one you keep immediately.
• Anything on screen is visible to anyone watching, including screen-sharing software.
• Symbol sets sometimes conflict with a site's own rules, so a rejected password may need regenerating with different classes.
• Length beats cleverness: dropping to a short password with symbols is weaker than a long one without.

Frequently asked questions

How long should a password be?

16 characters or more for an account, 32 or more for an API key or service credential. Aim for at least 80 bits of entropy shown in the result.

Are these passwords sent anywhere?

No. Generation happens in this browser tab and nothing is uploaded or logged.

Should I turn symbols on?

It adds a few bits, but adding characters adds more. Some systems mishandle symbols, so a longer alphanumeric password is often the practical choice.

What does “allow ambiguous characters” do?

It puts i, l, I, O, 0, 1 and o back into the alphabet. They are excluded by default because they cause transcription errors when a credential is dictated or retyped, and the few extra bits rarely justify that.

Related tools

• Random String — Random identifiers from a chosen alphabet
• UUID Generator — UUID v1 to v7 — generate any version, or read what one encodes
• Hash Generator — SHA-2, SHA-3, BLAKE and legacy digests, in any encoding
• Text Encryption — AES-256-GCM with a PBKDF2 passphrase
• MD5 Generator — MD5 digests, with a plain account of what they are still good for
• HMAC Generator — Keyed message authentication codes

More Security & Cryptography tools

• Hash Generator — SHA-2, SHA-3, BLAKE and legacy digests, in any encoding
• MD5 Generator — MD5 digests, with a plain account of what they are still good for
• HMAC Generator — Keyed message authentication codes
• Key Derivation — Stretch a passphrase into key material with PBKDF2, scrypt or Argon2id
• Password Strength — Judge a password by what an attacker would actually try
• JWK Generator — A JSON Web Key for a JOSE algorithm, with its key set and thumbprint id
• Key Pair Generator — RSA and elliptic-curve key pairs, generated in this tab and never sent
• TOTP / HOTP Generator — Two-factor codes, the QR code to enrol with, and why one did not match
• Text Encryption — AES-256-GCM with a PBKDF2 passphrase
• Bcrypt Generator — Hash a password with bcrypt, verify one against a hash, or read what a hash is made of