ToolLaunchpadHow to use the password generator
A password is created when the page loads. Adjust the length (4 to 128 characters) with the number field or the slider, choose which character sets to use and press Generate. Set How many to create up to 100 passwords at once, one per line.
- Exclude look-alikes removes characters that are easy to confuse when a password is read aloud or typed from paper:
I l 1 | O 0 o. - At least one from each set guarantees that every selected set appears, which many sign-up forms require. Passwords that miss a set are discarded and drawn again, so the result stays uniformly random among all passwords that meet the rule.
Every character is chosen with crypto.getRandomValues(), the browser's cryptographically secure random source, using rejection sampling so that no character is more likely than another. Nothing is sent anywhere or stored.
How the strength estimate works
The number shown is the entropy of the generator, in bits: log2 of the number of different passwords these settings can produce. With a pool of N characters and length L, that is L × log2(N). When "at least one from each set" is on, passwords that miss a set are not possible, so the tool counts the remaining combinations exactly and the value drops slightly.
| Settings | Pool | Entropy |
|---|---|---|
| 10 digits only | 10 | 33.2 bits |
| 12 characters, letters and digits | 62 | about 71 bits |
| 20 characters, all four sets (no rule) | 94 | 131.1 bits |
As a rough guide, below 60 bits is weak against an offline attack on a fast hash, 80 bits or more is strong, and above 100 bits is far beyond any brute-force attack. Every extra bit doubles the work for an attacker. Note that this calculation only applies to passwords generated randomly here. A password you invent yourself, such as Summer2026!, has far less entropy than its length suggests, because attackers try such patterns first.
Tips for using generated passwords
- Store them in a password manager and use a different password for every account. Reuse is a bigger risk than length.
- Length adds more strength than symbols. Going from 12 to 16 characters gains more than adding symbols to a 12-character password.
- If a site rejects some symbols, untick Symbols and add a few characters of length instead.
Common mistakes
- Using
Math.random()in your own code. It is not designed to be unpredictable. Usecrypto.getRandomValues()or your platform's secure random API. - Modulo bias. Mapping a random byte to a character with
% 62makes some characters more likely. This tool rejects out-of-range values instead. - Too short for the purpose. A 6-digit PIN has about 20 bits, which is fine only when the system limits guessing attempts.
Frequently asked questions
Are the passwords generated securely?
Yes. Each character is chosen with crypto.getRandomValues, the browser's cryptographically secure random number generator, and rejection sampling avoids bias. Generation happens on your device and nothing is transmitted or saved.
How long should my password be?
For accounts protected by a password manager, 16 to 20 random characters from all four sets give well over 100 bits of entropy. If you have to type the password often, a longer password with letters and digits only is equally strong.
What does entropy in bits mean?
It is log base 2 of the number of possible passwords the generator can create with your settings. 80 bits means about 1.2 septillion possibilities, and each extra bit doubles the number of guesses an attacker needs.
Why does the requirement for one character of each type lower the entropy?
Because it rules out passwords that miss a set, so fewer passwords are possible. The tool counts the remaining combinations exactly. With reasonable lengths the loss is a fraction of a bit.
Why exclude look-alike characters?
Characters like capital I, lowercase l, the digit 1 and the vertical bar are easy to mix up when reading a password aloud or copying it from paper. Excluding them makes the pool a little smaller, which the entropy estimate takes into account.
Does this tool store or see my passwords?
No. Passwords are generated in your browser and are never sent to our server or to the visitor statistics, and nothing is stored. They exist only in this browser tab until you close or reload it.