Summary: generate a strong password, free and private
A password generator creates random passwords so that nobody has to invent or remember them. To generate a strong password free and privately, open this page: a 16-character password is already waiting under Generated Passwords. Click Copy and paste it into your password manager. It is made in your browser with crypto.getRandomValues(), the browser's cryptographic random number generator, and nothing is sent to a server.
With the default settings (uppercase, lowercase, numbers and special characters, 16 characters) the meter shows about 103 bits of entropy, rated Very Strong. For a password you must remember, switch to Passphrase: six random words plus a number give about 79 bits. For a password, entropy in bits is roughly the length times log₂ of the pool size, and every extra bit doubles the guesses an attacker needs.
Table of Use: settings for common jobs
| You need | Settings | Strength shown |
|---|---|---|
| A password for an account kept in a password manager | Password, 16 characters, all four types (the defaults) | About 103 bits, Very Strong |
| A site that rejects symbols | Untick Include Special Characters, 16 characters | About 95 bits, Very Strong |
| A password to read aloud or type from a printout | Tick Exclude Ambiguous Characters (0, O, l, 1), 16 characters | About 101 bits, Very Strong |
| A master password you must remember | Passphrase, 6 words, random number on | About 79 bits, Strong |
| A password that is easy to say aloud | Tick Generate Pronounceable Password, 12 characters | About 40 bits, Fair |
| Test accounts for a staging site | Number to Generate 50, then Download All (.txt) | Each one is random on its own |
Meter readings for other lengths (all four character types) and for passphrases:
| Setting | Entropy | Label |
|---|---|---|
| Password, 8 characters | About 50 bits | Good |
| Password, 12 characters | About 77 bits | Strong |
| Password, 16 characters | About 103 bits | Very Strong |
| Password, 20 characters | About 129 bits | Very Strong |
| Passphrase, 4 words and number | About 57 bits | Good |
| Passphrase, 6 words and number | About 79 bits | Strong |
| Passphrase, 8 words and number | About 101 bits | Very Strong |
Features
- Passwords. Length from 4 to 128 characters (starting at 16), with uppercase, lowercase, numbers and special characters all on by default. Every selected type appears at least once.
- Options. Exclude ambiguous or similar characters, generate a pronounceable password (letters plus two digits, weaker per character), or use your own character set.
- Passphrases. 3 to 12 words from a 2,048-word list, with a choice of separator, capitalised words and an optional random number from 0 to 9999.
- Bulk and export. Generate 1 to 100 at once, hide or show each with the eye button, copy one, or save them all with Download All (.txt).
- Private. No sign-up and nothing stored. The passphrase word list is loaded from this site only when you open Passphrase.
Need an identifier rather than a secret? Try the UUID generator, the random string generator or the random number generator.
How to Use the Password Generator
- Choose Password or Passphrase at the top of the tool.
- For a password, drag the Length slider and tick the character types you want. For a passphrase, set Number of Words and Word Separator.
- Set Number to Generate if you need more than one.
- Check the Strength line. A new result appears whenever a setting changes, and Generate New Password makes another.
- Click Copy beside a result, use the eye button to hide it, or click Download All (.txt) for the whole list. Clear removes them.
- Paste the password into your password manager.
Who Can Use a Password Generator
Anyone opening a new account can replace a reused password with a unique one. IT administrators generate temporary passwords in bulk. Developers create test credentials, encode secrets with the Base64 encoder and fingerprint values with the SHA-256 hash generator. People who keep notes private can lock them with the text encryption tool and open them with the text decryption tool. The name generator helps with usernames, and anyone choosing a master password should pick a passphrase.
FAQs
How long should my password be?
For accounts kept in a password manager, use 16 or more random characters: with all four character types, 16 characters give about 103 bits of entropy, rated Very Strong. Where a site caps the length, use at least 12 characters, which gives about 77 bits. For a password you must remember, such as a password manager master password, use a passphrase instead.
Should I use a password or a passphrase?
Use random passwords for everything a password manager stores, because they pack the most strength into the fewest characters. Use a passphrase for the few secrets you must type from memory. Each word comes from a list of 2,048 words, so it adds exactly 11 bits: six words give 66 bits, and the optional number adds about 13 more, for about 79 bits.
What does the password strength meter measure?
It shows the entropy of your settings: how many equally likely passwords they can produce, written as a power of two. It comes from the pool size and the length, not from scanning the result for patterns. Under 36 bits is Weak, 36 to 49 Fair, 50 to 69 Good, 70 to 89 Strong and 90 or more Very Strong. Each extra bit doubles the guesses needed.
Are the generated passwords truly random?
Yes. Every character and word is chosen with crypto.getRandomValues(), the browser's cryptographic random number generator, using rejection sampling so there is no modulo bias. When several character types are selected, any password that misses a type is thrown away and redrawn, so every type appears and every valid password stays equally likely. Math.random() is never used.
Is it safe to use an online password generator?
Passwords here are made on your device and never transmitted. Open the Network tab in your browser's DevTools and you will see that generating sends no request carrying a password. Nothing is stored, and passwords vanish when you reload the page. Move each one into a password manager straight away, and delete any downloaded .txt file afterwards.
What do Exclude Ambiguous and Exclude Similar Characters do?
Exclude Ambiguous Characters removes 0, O, l and 1, which are easy to confuse when read aloud or typed from a printout. Exclude Similar Characters removes i, I, l and L. Both shrink the character pool slightly: excluding the ambiguous set takes a 16-character password from about 103 to about 101 bits, still Very Strong. Both are off by default.