How this generator works
Each character is picked with crypto.getRandomValues, the cryptographically secure random source built into modern browsers. The tool uses rejection sampling so every character in the pool is exactly equally likely, guarantees at least one character from each type you select, and then shuffles the result. Generation happens offline in your tab: the page makes no network requests, so no password ever leaves your device.
How strong should a password be?
Strength is measured in bits of entropy: length × log2(pool size). A 16-character password using lower case, upper case, digits and symbols has about 105 bits. Every extra bit doubles the number of guesses an attacker needs. The time shown assumes an offline attack at 10 billion guesses per second, which is a rough estimate for a fast GPU rig against a weak hash; real-world times vary a lot.
| Length (all 4 types) | Approx. entropy |
|---|---|
| 8 | 52 bits |
| 12 | 79 bits |
| 16 | 105 bits |
| 20 | 131 bits |
Good password habits
- Use a different password for every account; reuse is the main way accounts get taken over after a data breach.
- Store passwords in a reputable password manager rather than a notes file.
- Turn on two-factor authentication for email, banking and gaming accounts.
- For a password you must type often, a longer passphrase of random words can be easier to remember.
The strength checker
Type any password into the checker to see a rough estimate. It penalises common patterns such as “password”, “qwerty” and “12345”, and repeated characters. It is a simple estimate, not a guarantee: a password that appeared in a past breach can be guessed instantly regardless of its length.
FAQ
Is this password generator safe?
Yes. Passwords are created in your browser with the Web Crypto API and are never sent or saved. You can even use the page offline.
How long should my password be?
At least 12 characters for everyday accounts, and 16 or more for email, banking and password-manager master passwords.
Are symbols necessary?
Length matters more than symbols, but symbols enlarge the pool and add entropy per character. Some sites reject certain symbols, so you can turn them off.
What does 'avoid look-alikes' do?
It removes characters that are easy to confuse, such as 0 and O or l, 1 and I, which helps when you must read or type the password.
Can I generate a 12 or 16 character password?
Yes. Move the length slider to any value from 6 to 64; your choice is remembered on this device.