Password Generator
Generate strong random passwords in your browser, with a live entropy estimate. Nothing is transmitted or stored.
Output
What actually makes a password strong
Strength is measured in entropy: how many guesses an attacker needs on average. Entropy comes from length multiplied by the size of the character set — not from substituting @ for a, which attackers’ dictionaries have handled for twenty years.
A 16-character password from a 94-character set carries about 104 bits of entropy, which is beyond brute force. The same 104 bits cannot be reached with a short password no matter how many symbols you add.
- Under 50 bits — guessable by a determined attacker.
- 50–72 bits — adequate for low-value accounts.
- 72–128 bits — comfortably strong for anything you care about.
- Above 128 bits — beyond what brute force can reach.
Where the randomness comes from
Characters are drawn with crypto.getRandomValues using rejection sampling. The simpler `random % alphabet.length` approach biases the result toward the first characters of the alphabet — a small flaw, but exactly the kind that makes a password weaker than its length suggests.
Nothing is sent anywhere. The page has no network calls at all, so the generated password exists only on your device and in whatever you paste it into.
Frequently asked questions
Is it safe to generate a password on a website?
On this one, generation happens entirely in your browser with no network request. That said, the safest habit remains generating passwords inside a password manager you already trust.
Should I exclude look-alike characters?
Only if a human will read or transcribe the password. Removing them slightly shrinks the alphabet and therefore the entropy, so leave them in for anything a manager will store.
How long should a password be?
At least 16 characters for an account that matters. If the site imposes a low maximum length, use the full length it allows and enable two-factor authentication.