Password Generator

2026-10-17

Make strong random passwords or word-based passphrases in your browser. Pick the length and character sets, see the entropy in bits with a plain-language strength rating, and generate up to 50 at once. Nothing is sent anywhere.

How to use the password generator

1. Choose Password (random characters) or Passphrase (random words that are easier to read and type).
2. For a password, set the length and tick the character sets you want. Type extra characters into the custom field if you need them.
3. Optionally exclude look-alike characters. Keep “At least one from each set” on if a site demands a mix of character types.
4. For a passphrase, choose the number of words, a separator, and whether to capitalize them or add a number.
5. Set how many to make (1–50). The list updates when you change a setting; press Generate new for a fresh batch.
6. Press Copy next to one result, or Copy all for one per line, and save it in a password manager.

How it works

The page asks the browser for random numbers with crypto.getRandomValues, the secure generator the operating system also uses for encryption keys. It never uses Math.random, which is not designed to be unpredictable.

To pick one character from a pool of N, the obvious method is number % N. That is slightly unfair: a 32-bit number has 4,294,967,296 values, and unless N divides that exactly, the first few characters come up a little more often (modulo bias). The tool uses rejection sampling instead: it computes limit = floor(232 / N) × N, discards any random number at or above limit, and takes the remainder of the rest. Every character is then exactly equally likely. For pools of a few thousand characters or fewer, under one draw in a million is discarded.

With “At least one from each set” on, the tool does not force characters into fixed positions. It draws a whole password and, if a set is missing, throws it away and draws again, so every acceptable password is equally likely.

Entropy measures how many equally likely results the settings can produce. For a password of length L from a pool of N characters:

entropy (bits) = L × log2(N)

Every extra bit doubles the possibilities. With the “at least one from each set” rule on, the tool counts exactly how many strings pass it (inclusion and exclusion over the sets) and reports the log2 of that count: a little lower than the formula, and noticeably lower for very short passwords. For a passphrase of k words from a list of W: entropy = k × log2(W). The label depends only on the bits:

The time estimate assumes an attacker holding a stolen password database who can try 10 billion guesses per second against a fast, unsalted hash, and who succeeds on average after trying half of all possibilities. Sites with slow hashing and login limits are far harder to attack, and a reused or leaked password falls at once whatever its entropy.

Passphrases. The built-in list has exactly 1,024 common English words of four to seven letters, chosen for this page, so each word adds 10 bits. Words are drawn independently and can repeat; the estimate assumes an attacker knows the list and your settings. Dice-based lists have 7,776 words (about 12.9 bits each), so this list needs more words for the same strength. Capitalizing adds no entropy because it is predictable; the optional number adds log₂(100) ≈ 6.6 bits.

Examples

Example 1 — 12 lowercase letters. The pool is 26 characters: 12 × log2(26) = 12 × 4.700 = 56.4 bits, rated Fair. The tool estimates about 55 days on average at 10 billion guesses per second, which is little protection against a determined attacker.

Example 2 — the default settings. Length 16 with all four sets gives 26 + 26 + 10 + 25 = 87 characters, so 16 × log2(87) = 103.1 bits. With “at least one from each set” on, the exact count is slightly lower and the tool shows 102.8 bits, Very strong.

Example 3 — no look-alikes. Length 20, lowercase, uppercase and digits, with look-alikes excluded and the one-from-each rule on. Removing I, l, 1, O and 0 leaves 62 − 5 = 57 characters: the formula gives 116.7 bits and the tool shows 116.6. Without the exclusion it is 119.1 bits, so the five confusing characters cost only about 2.4 bits.

Example 4 — a six-word passphrase. 6 × 10 = 60 bits, rated Strong. Adding the random number gives 66.6 bits; eight words give 80 bits, rated Very strong.

What makes a password strong

• Length and true randomness. Each extra character multiplies the possibilities. A random 16-character password beats a clever 10-character one built on substitutions such as “@” for “a”, which attackers try first.
• One password per account. A breach at one site exposes the password you used there; if you reused it, your other accounts are exposed too.
• A password manager. Random passwords cannot be memorized, so let a manager store them and memorize only its master passphrase.
• No hand edits. Swapping letters or keeping only the parts you like lowers the entropy the tool reported.

Password or passphrase?

Use a random password for anything a manager fills in, because length costs nothing. Use a passphrase for the few secrets you must type or remember: a device unlock, a disk encryption password or the manager’s master password. If a site rejects symbols, untick Symbols and raise the length instead.

Frequently asked questions

Is the output really random?

Yes. The characters come from the browser’s secure random generator, and the selection method has no modulo bias. There is no seed, so the same settings give a different result each time.

How long should my password be?

If a manager stores it, 16 random characters from several sets (about 100 bits) is plenty. Twelve characters from all four sets gives about 77 bits, a reasonable minimum. Go longer for valuable accounts.

What does “exclude look-alikes” do?

It removes I (capital i), l (lowercase L), 1 (one), O (capital o) and 0 (zero) from every set, including your custom characters. That helps when you read a password aloud or copy it by hand, at a small cost in entropy.

Which symbols are included?

The 25 characters ! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . ? / ~. Quotes, backslashes, angle brackets and the backtick are left out because they cause trouble in forms and command lines. Type any others you want into the custom field.

Why is a short password weaker than the formula says?

The “at least one from each set” rule removes possibilities. At length 4 with four sets, most random strings miss a set, so far fewer remain. The tool counts them exactly and refuses combinations where fewer than one string in a thousand would qualify.

Are my passwords stored or sent anywhere?

No. Everything runs in your browser with no server request. Generated passwords exist only on this page until you close or refresh it. Your settings, including any custom characters you type, are saved in your browser’s local storage; clear the site data to remove them.

A generated password is only as safe as the place you keep it. Do not email it to yourself or save it in an unprotected note.

Related tools

• Permutation & Combination Calculator — count arrangements and selections, the maths behind password strength.
• List Randomizer — shuffle any list into a random order.
• Random Name Picker — draw winners fairly from a list of names.
• Regex Tester — test a regular expression, for example a password rule, against sample text.
• JSON Formatter — format, validate and minify JSON in the browser.