Password Generator
Generate a strong random password of any length from 6 to 128 characters — choose uppercase, lowercase, numbers and symbols, and optionally exclude similar or ambiguous characters. Created in your browser with a cryptographic RNG and never transmitted.
Input
Output
Entropy is the size of the search space an attacker must cover — 80+ bits is comfortable for an account password, 112+ for anything long-lived.
Guides
Create a strong, genuinely random password — anywhere from 6 to 128 characters — from the character types you choose. The password is built in your browser with a cryptographic random number generator and is never sent anywhere.
How to use it
- Drag the length slider. Longer beats clever: 16 characters is a sensible floor, 20+ for anything valuable.
- Tick the character types you want: symbols, numbers, lowercase, uppercase. At least one is required.
- Optionally exclude similar characters (
i,l,1,L,o,0,O) if you will have to read the password off a screen or type it on a TV remote. - Optionally exclude ambiguous characters (
{ } [ ] ( ) / \ ' " \~ , ; : . < >`) if the password has to survive a config file, a shell command, or a form that mangles punctuation. - Click Generate password, then copy it straight into your password manager.
The strength line reports the password's entropy — the size of the search space an attacker has to cover, calculated as length × log2(alphabet size).
Frequently asked questions
How long should my password be?
Length is worth more than complexity. A 16-character password drawn from all four character types has about 104 bits of entropy, which is far beyond brute-force reach. A 20-character letters-and-numbers password (115 bits) is stronger than a 12-character one stuffed with symbols. Aim for 80+ bits for a normal account and 112+ bits for anything long-lived, like an encryption key passphrase or a root account.
What do the strength labels mean?
They map to entropy: under 36 bits is very weak, 36–59 weak, 60–79 medium, 80–111 strong, and 112 bits or more very strong. Because these passwords are drawn uniformly at random, entropy is the honest measure — there is no dictionary word, keyboard pattern, or birth year for a cracker to exploit.
Why should I exclude similar or ambiguous characters?
Only for practical reasons. Excluding look-alikes stops you mistyping l for 1 when reading a password aloud or off a printout. Excluding brackets and quotes keeps a password from breaking a shell command or a .env file. Both shrink the alphabet slightly, so add a couple of characters of length to compensate.
Is a random password better than a passphrase?
They are two ways to buy the same entropy. A random password packs more of it per character, which matters when a site caps password length. A passphrase is easier to remember. If you use a password manager — and you should — you never type the password, so random wins.
Do I need a different password for every site?
Yes. Reuse is the single biggest cause of account takeover: one breached site hands an attacker the keys to every other account with the same password. Generate a fresh one here for each site and let a password manager remember them.
How random is this really?
Every character is drawn from crypto.getRandomValues — the platform's cryptographically secure random number generator — using rejection sampling, so each character in the alphabet is exactly equally likely. Math.random() is never used; it is predictable and unfit for secrets.
Privacy
The password is generated entirely on your device. It is never transmitted, logged, or stored, and it is deliberately excluded from shareable links — a share link carries your settings only, never the generated password.