Password Generator
Create strong, random, secure passwords instantly — built on cryptographically secure randomness. Free, fast and private: passwords are generated on your device and never uploaded.
How to generate a strong password
- Set the length with the slider — 16 or more characters is recommended.
- Tick the character sets you want: uppercase, lowercase, digits and symbols. Optionally exclude ambiguous look-alike characters.
- Click Generate, then Copy to use your new secure password.
The strength meter updates live as you adjust the length and character sets, showing both a rating and an estimated entropy in bits. There is nothing to install and no limit on how many passwords you create — generate one for every account, regenerate as often as you like, and nothing ever leaves the browser tab.
Why use a secure password generator?
People reuse weak, guessable passwords — and that is how accounts get breached. A strong random password generator removes the human bias that makes passwords predictable, drawing each character from a cryptographically secure source so attackers cannot anticipate the result. The more length and character variety you allow, the more astronomically large the search space becomes, putting brute-force attacks out of reach. Because everything runs in your browser, your password is never transmitted or logged anywhere, so you can paste it straight into your password manager with confidence.
What makes a password strong: entropy explained
Password strength is best measured in bits of entropy, a number that captures how many guesses an attacker would need on average. Each extra bit doubles the work. Entropy is calculated as the password length multiplied by the base-2 logarithm of the pool size — the number of characters available — so both a longer password and a larger character pool push it higher. A 12-character password drawn from lowercase letters alone offers about 56 bits; the same length using all four sets jumps to roughly 79 bits, and stretching to 16 characters across all sets clears 100 bits. The table below shows how length and character variety combine.
| Length | Character sets | Pool size | Approx. entropy |
|---|---|---|---|
| 8 | Lowercase only | 26 | ~38 bits — weak |
| 12 | Upper + lower + digits | 62 | ~71 bits — fair |
| 16 | All four sets | ~94 | ~105 bits — very strong |
| 24 | All four sets | ~94 | ~157 bits — overkill, future-proof |
As a rule of thumb, anything under 40 bits is weak, 40–60 is fair, 60–80 is strong, and above 80 bits is very strong. The meter on this tool uses those same thresholds.
Common use cases
- New account sign-ups — generate a unique password and save it straight into your password manager instead of inventing one yourself.
- Rotating a breached password — quickly replace a credential that turned up in a data-leak alert.
- API keys, database and admin secrets — produce long, symbol-rich strings for service accounts and config files.
- Wi-Fi and router passphrases — turn on exclude ambiguous characters so the key is easy to read aloud or type on a phone.
- Temporary credentials — hand a colleague a one-off password that you will rotate after first use.
Tips & gotchas
- Length beats complexity. Adding characters raises entropy faster than adding exotic symbols. A long passphrase-length random string is stronger than a short one stuffed with punctuation.
- Never reuse passwords. One leaked site should not compromise the rest — generate a fresh password per account.
- Use a password manager. You cannot memorise 100-bit strings, and you should not try. Let a manager store them and only remember one strong master password.
- Mind site limits. Some services cap length or ban certain symbols — shorten or drop the symbol set here rather than picking a weak password.
- Generate fresh, do not edit. Tweaking a generated password by hand reintroduces the human bias the tool exists to remove. If you do not like one, click Generate again.