How to use the Password Generator
- 1Move the length slider to choose between 8 and 64 characters (16 is the default).
- 2Tick the character types to include: Uppercase, Lowercase, Numbers and Symbols.
- 3Optionally tick Exclude look-alike characters to leave out 0, O, l, 1 and I.
- 4Click Generate to create a new password and check the strength meter.
- 5Click Copy and paste the password into your account or password manager.
What makes a password strong?
A strong password is one an attacker cannot guess or crack in any realistic amount of time. Its strength depends on two things: how many possible characters each position could be (the character pool) and how many characters there are (the length). Just as important, it must be truly random and used for only one account, so a leak on one site cannot be used to break into another. Well-run websites store only a hash of your password, a one-way fingerprint you can explore with the hash generator.
This generator uses the browser’s crypto.getRandomValues function, which provides cryptographically secure randomness. Passwords are created locally and are not saved, logged or transmitted. For picking random numbers within a range, use the random number generator.
Password entropy explained
Entropy measures unpredictability in bits. For a randomly generated password, entropy = length × log2(pool size). Each extra bit doubles the number of guesses needed. The strength meter rates passwords as Weak below 50 bits, Fair from 50 to under 70, Strong from 70 to under 100, and Very strong at 100 bits or more.
As examples, 8 characters drawn from about 94 printable characters give roughly 52 bits. Sixteen lowercase letters give about 75 bits. Sixteen characters from a pool of around 90 mixed characters give about 104 bits. Excluding look-alike characters shrinks the pool slightly, so entropy drops a little, which you can offset by adding a character or two. For unique identifiers rather than secrets, use the UUID generator instead.
Length vs complexity
Length usually adds more strength than complexity. Adding symbols to a 12-character password raises the pool from 62 to around 94 characters, gaining about 7 bits, while adding four more characters to the same 12-character password gains about 24 bits. Current guidance, including NIST’s digital identity guidelines, favours longer passwords over forced complexity rules. Still, some sites require symbols or numbers, so include them when needed.
Password managers and passphrases
Random passwords are hard to remember, which is why a password manager is the most practical approach. It stores a unique password for every account, fills them in for you, and only requires you to remember one strong master password. Turning on two-factor authentication adds another layer of protection.
For the few passwords you must memorise, such as your master password, a passphrase of several random words is a good choice. Each word chosen at random from a list of 7,776 words adds about 12.9 bits, so six random words give about 77 bits while remaining easy to type and recall. The words must be picked randomly, not from a familiar phrase or quote.
Frequently asked questions
How long should my password be?
For most online accounts, 16 characters with mixed character types is a strong default. For high-value accounts such as email, banking or a password manager, 20 or more characters gives an extra margin. If a site limits length, use the maximum it allows.
Is it safe to use an online password generator?
It is safe when the password is generated locally and never sent anywhere, as it is here. This tool runs in your browser using crypto.getRandomValues, and the password is not stored or transmitted. You can even disconnect from the internet after the page loads and it will still work.
Why exclude look-alike characters?
Characters such as 0 and O, or l, 1 and I, are easy to confuse when reading a password aloud or typing it from a printout. Excluding them makes passwords easier to transcribe at the cost of a slightly smaller character pool.
What does the strength meter measure?
It estimates entropy in bits from the password length and the size of the character pool you selected. Higher entropy means more possible combinations an attacker would need to try.
Should I change my passwords regularly?
Current security guidance recommends changing a password when there is a sign it has been compromised, rather than on a fixed schedule. Using a unique, strong password for every account matters more than frequent changes. Never assume a password stored in an encoded form such as Base64 is protected; the Base64 encoder and decoder shows how easily it is reversed.