Password Generator

About Password Generator

A strong password generator creates random, hard-to-guess passwords for your accounts. Choose the length and whether to include uppercase, lowercase, numbers, and symbols, and get a secure password instantly — with an option to exclude look-alike characters like l, 1, I, O, and 0. Switch to word mode for a passphrase built from real words, which is far easier to remember and type when you have to enter it by hand. Either way it's generated locally with cryptographically secure randomness and never leaves your browser, so nothing is transmitted, logged, or stored.

Length beats complexity

Every character you add multiplies the number of possible passwords; adding a symbol only widens the alphabet. From a 94-character keyboard set, each extra character multiplies the search space by 94 — roughly 6.5 bits of entropy. Going from 12 to 16 characters multiplies the work of guessing by about 78 million.

That is why a 16-character lowercase-and-digit password is far stronger than an 8-character one bristling with symbols. If you have to choose between making a password longer and making it more complicated, make it longer every time. The complexity rules most sites impose exist to stop people choosing dictionary words, not because symbols are inherently strong.

What the strength estimate means

Strength is usually expressed in bits of entropy, which is a measure of how many guesses an attacker needs on average. Each bit doubles that number. Around 60 bits is comfortable for an ordinary account; 80 or more is appropriate for anything protecting money, email, or other accounts.

The critical caveat is that entropy only describes randomly generated passwords. A password you invented has far less entropy than its character count suggests, because human choices cluster — capital at the front, digits and a symbol at the end, a word in the middle. Attackers model those patterns. A generated string of the same length can be thousands of times harder to guess than one you thought up.

Where randomness comes from

The randomness here comes from the browser's cryptographic generator, which is seeded from operating-system entropy and designed so that seeing previous output tells you nothing about what comes next. That is the important property. An ordinary random function, the kind used for shuffling a list or picking a colour, is predictable from a short run of its output and must never be used for a secret.

Generation happens entirely on your device. Nothing is sent over the network, so there is no server that could log the password, no request to intercept, and nothing that persists after you close the tab.

When a passphrase beats a random string

Word mode builds a passphrase by picking whole words at random from a 7,776-word list. Each word is worth about 12.9 bits, so a six-word phrase carries roughly 77 bits — about as hard to guess as a twelve-character random password, while being far easier to read off a screen and type on a phone or a TV remote.

The strength comes from the number of words and the size of the list, not from the words being unusual. Assume the attacker knows exactly which list was used; guessing still means working through 7,776 to the power of six. What does destroy a passphrase is choosing the words yourself — human picks cluster around common nouns and personal associations, and that is precisely what cracking tools model. Capitalising the words or bolting a digit on the end satisfies fussy signup forms but adds almost nothing an attacker would notice, which is why the strength meter here does not count either of them.

Using generated passwords well

A generated password only helps if it is unique to one account. The most common way people lose accounts is not a password being cracked but a password being reused: one site is breached, the address and password are tried everywhere else, and the strong password you carefully created protects nothing. Assume any password used twice is already compromised.

That implies a password manager, because nobody remembers forty random strings. Reserve the ones you must memorise — your device login and your password manager's own master password — and make those long passphrases rather than short complex strings. The exclude-look-alikes option is worth turning on for anything you will read off a screen and type by hand, where confusing l with 1 or O with 0 costs more than the small loss in alphabet size.

Frequently asked questions

Are these passwords safe to use?

Yes. Each password is generated in your browser with cryptographically secure randomness and is never sent over the network, logged, or stored anywhere — it works even if you go offline after the page loads.

How long should my password be?

Aim for at least 16 characters with a mix of character types — that's the default here. Longer is stronger, and the tool shows a live entropy estimate in bits as you adjust the length.

Can I make a password out of words instead?

Yes — switch to word mode for a passphrase like 'garnet-snitch-dropkick-squeamish'. Pick 3 to 10 words, choose the separator, and optionally capitalise them or add a digit for sites that insist. Six words is about as strong as a twelve-character random password and much easier to remember.

Can I generate a password without similar-looking characters?

Yes. Turn on 'exclude similar characters' to drop look-alikes such as i, l, 1, L, o, 0, and O, so the password is easier to read and type without ambiguity.

Do I need to sign up or install anything?

No. It's a free online password generator that runs entirely in your browser — no account, no download, and no limit on how many passwords you create.