Password Generator
Cryptographically random passwords, 4 to 64 characters, built in this tab and sent nowhere.
Tick No look-alikes to skip capital O, zero, lowercase L, capital i and one. Generated in this tab with crypto.getRandomValues.
Generate 25 at once
Fill a batch for a team, a set of service accounts or a password rotation, then copy the lot.
Uses the length and character sets set above. The batch stays in this tab, same as the single password.
The four character sets
What each switch adds to the pool, and what the look-alike filter costs you.
| Set | Characters | Count | Without look-alikes | Notes |
|---|---|---|---|---|
| Lowercase | abcdefghijklmnopqrstuvwxyz | 26 | 25 | The base of every readable password. Drops l when No look-alikes is on. |
| Uppercase | ABCDEFGHIJKLMNOPQRSTUVWXYZ | 26 | 24 | Doubles the letter pool. Drops O and I when No look-alikes is on. |
| Digits | 0123456789 | 10 | 8 | Small, but most password rules ask for one. Drops 0 and 1 when No look-alikes is on. |
| Symbols | !@#$%^&*()-_=+[]{};:,.<>?/~ | 27 | 27 | The biggest single gain per character. Some sites still reject a few of these. |
What the rating means
Entropy is length times the log base 2 of the pool size. These are the four bands this tool reports.
Weak
under 35 bits
Falls to an offline guessing rig. Fine for a throwaway forum, nothing else.
Fair
35 to 59 bits
Survives casual guessing. Still short of what a leaked hash needs.
Strong
60 to 79 bits
Good for an ordinary account you also protect with 2FA.
Very strong
80 bits and up
Out of reach of current hardware. This is where a 16-character password lands.
How long to make it
Entropy against the full 89 character pool, and what each length is for.
| Length | Entropy | Rating | Use it for |
|---|---|---|---|
| 8 | ~52 bits | Fair | A site with a legacy limit. Change it when the limit lifts. |
| 12 | ~78 bits | Strong | The practical floor for anything you care about. |
| 16 | ~104 bits | Very strong | The default here, and the one to use with a password manager. |
| 24 | ~155 bits | Very strong | Master passwords, recovery keys, anything reused as a root of trust. |
| 32 | ~207 bits | Very strong | API keys and service credentials you never type by hand. |
How it works
Why it is actually secure
Passwords are built with crypto.getRandomValues, your browser’s cryptographic random source, with rejection sampling to avoid modulo bias. A 16 character password using all sets has about 104 bits of entropy: brute forcing it would take longer than the age of the universe on current hardware.
One character from every set you tick is placed first, then the rest are drawn from the whole pool, then the lot is shuffled. That is how a password can satisfy a "must contain a digit" rule without the digit always landing in the same place.
The password never leaves this tab
Generation happens in this page. The password is never sent, never stored and never logged. Close the tab and it is gone. Disconnect from the internet first if you want to prove it: the generator still works.
To be exact about the rest: the page posts one anonymous open on load, the same count every page here posts, and the Premium batch checks whether your account is entitled. Neither carries a password, and neither fires while you generate. That is the whole list, and it is what you will see in the network panel.
Password tips
Length beats complexity: 20 lowercase letters are stronger than 8 mixed symbols. Never reuse passwords across sites, because one breach exposes everything. Use a password manager so you only memorise one.
Questions
Is this password generator actually secure?
Passwords are built with crypto.getRandomValues, your browser’s cryptographic random source, using rejection sampling so no character is more likely than another. Generation happens in the page. Nothing about the password is sent to a server, and it is never logged. The page counts one anonymous open, the same as every page here.
How long should a password be?
Length beats complexity. Twenty lowercase letters are stronger than eight mixed symbols. Sixteen characters from all four sets is about 104 bits of entropy, which is out of reach of current hardware. Use 12 as a floor and 16 as a habit.
What does the entropy rating mean?
Entropy is length multiplied by the log base 2 of the pool size, in bits. It measures how many guesses an attacker needs, not how odd the password looks. Under 35 bits is weak, 35 to 59 is fair, 60 to 79 is strong, and 80 or more is very strong.
Should I turn on the look-alike filter?
Turn it on for a password you will read off a screen and type by hand, since it removes capital O, zero, lowercase L, capital i and one. It shrinks the pool from 89 characters to 84, so add a character or two of length to make the difference back.
Do I need a password manager as well?
Yes. Never reuse a password across sites, because one breach then exposes every account. A manager means you memorise one password and generate the rest. This tool makes the ones you paste in.