How to use it
- Set the length with the slider or type an exact number of characters (4–128).
- Choose which character types to include. Edit the symbol list if a website only accepts certain symbols.
- Optionally exclude look-alike characters, and keep “Use every selected type at least once” on for sites with composition rules.
- Copy a single password, or use “Copy all” to copy every password, one per line. Press “Generate again” for a new set.
How it works
Every character is chosen with crypto.getRandomValues, the cryptographically secure random number generator built into your browser. Math.random is never used. To pick a character from a pool of n characters, the tool draws a 32-bit random number and discards values that fall in the small leftover range above the largest multiple of n. This rejection sampling avoids modulo bias, so every character in the pool is exactly equally likely.
When “Use every selected type at least once” is on, the tool first picks one character from each selected type, fills the remaining positions from the combined pool, and then shuffles all positions with a Fisher–Yates shuffle driven by the same unbiased random source. That way the guaranteed characters do not always appear at the start.
The entropy figure is log2(pool size) × length. A 16-character password from all 89 default characters has about 103 bits, and a 20-character one about 129 bits. The “use every type” rule slightly reduces the number of possible passwords, so the true entropy is a little lower than shown. The labels are a rough guide: under 28 bits is very weak, 28–39 weak, 40–59 fair, 60–99 strong and 100 or more very strong. Entropy only describes passwords generated randomly like these; it says nothing about passwords a person invents.
Examples
A password for a password manager entry
Keep the defaults (20 characters, all four types). The result has about 129 bits of entropy, far beyond what can be guessed, and your password manager will remember it for you.
A site that rejects some symbols
If a bank only accepts !@#$%, replace the symbol list with those five characters. The pool shrinks to 67 characters, so a 16-character password still has about 97 bits.
A Wi-Fi password you have to type on a TV
Turn symbols off and exclude look-alike characters. Without I, l, 1, O, 0 and o, a 16-character password from the remaining 56 letters and digits is easy to read aloud and still has about 93 bits.
Frequently asked questions
How long should my password be?
For accounts protected by a password manager, 16–20 random characters is plenty. If you must type the password often, a longer password with only letters and digits is easier to enter and can be just as strong as a shorter one with symbols.
Is it safe to generate passwords on a website?
This page builds passwords entirely in your browser with the operating system's secure random source. They are not sent to a server, saved or included in analytics. You can disconnect from the internet after the page loads and it keeps working.
Why does excluding look-alike characters lower the entropy?
Entropy depends on how many characters each position can take. Removing characters makes the pool smaller, so each character adds slightly fewer bits. Adding a few more characters to the length makes up for it.
What does “modulo bias” mean, and why does it matter?
A naive generator takes a random number and uses the remainder after dividing by the pool size. Unless the pool size divides the random range evenly, some characters come up slightly more often. This tool rejects the uneven tail and draws again, so all characters are equally likely.
Privacy
Passwords are generated in your browser with crypto.getRandomValues. They are not uploaded, stored, logged or sent to analytics; only an anonymous event that the tool was used is recorded. Copying uses your device's clipboard.