Strong Password Generator — Random Passwords Made on Your Device

How to use the strong password generator

1. Set the Length with the slider, from 4 to 128 characters. It starts at 20.
2. Choose the character types: Uppercase (A–Z), Lowercase (a–z), Digits (0–9) and Symbols (!@#$…).
3. Tick Exclude look-alikes if you may need to read or type the password by hand, and add any characters a site does not allow to Also exclude these characters.
4. Keep Include at least one of each chosen type ticked if a site insists on, for example, a digit and a symbol.
5. Set How many passwords, press Generate, and copy the result. Check the Strength, Entropy and Character pool figures.

What it does and when to use it

A strong password is one an attacker cannot guess, and people are poor at inventing random strings. We reach for names, dates and patterns that attackers try first. This generator gives you truly random passwords instead, and tells you exactly how strong they are.

Use it to:

• Create a new password for an account, ready to save in your password manager.
• Replace a password after a data breach.
• Make Wi-Fi keys, database passwords or service account credentials.
• Meet a site’s rules, such as a maximum length or banned symbols.

Need many at once, for example for a batch of test users? The Bulk Password Generator makes up to 1,000 and lets you download them. To check how strong an existing password is, try the Password Strength Tester. For unique IDs rather than secrets, use the UUID Generator.

How it works

• Randomness. Each character is picked with crypto.getRandomValues, the browser’s cryptographically secure random source. Picks are rejection-sampled so that every character is equally likely. Math.random is not used.
• The pool is the set of characters you allowed. All four types give 94 characters: 26 uppercase, 26 lowercase, 10 digits and 32 symbols.
• Entropy is log₂ of the exact number of passwords the settings allow. With “include at least one of each type” on, passwords missing a type are not allowed, so the tool counts the allowed ones exactly instead of using the simple formula length × log₂(pool).
• Strength labels are this site’s own bands: below 28 bits very weak, below 36 weak, below 60 fair, below 80 strong, and 80 or more very strong.

Everything happens on your device. The password is never sent or stored.

Worked examples

The default. 20 characters from all four types, with at least one of each, gives a Character pool: 94 and Entropy: 130.9 bits, rated Very strong. Without the “one of each” rule, it would be 131.1 bits, because a few more passwords are allowed.

Easy to read aloud. 16 characters of letters and digits with look-alikes excluded uses a pool of 56 characters and gives Entropy: 92.8 bits, still Very strong.

Too short and too simple. 8 lowercase letters gives only 37.6 bits, rated Strength: Fair. Length matters more than variety: 16 characters of lowercase and digits allow far more combinations than 8 characters from all 94.

Limits and tips

• Entropy assumes the attacker knows your settings but not the random picks. That is the honest way to measure a generated password.
• Some sites limit length or symbols. Use the exclude box rather than editing the password by hand, which can weaken it.
• Never reuse a password across sites, however strong it is.