Password Generator

How each password is built

The generator joins the character sets you ticked into one pool: 26 uppercase letters, 26 lowercase letters, 10 digits and 26 symbols, for 88 characters when everything is on. It then asks crypto.getRandomValues for one 32-bit random number per character and maps each number onto the pool with a remainder. Because 2³² does not divide evenly by 88, a few characters are very slightly more likely than others: about one part in 49 million, which makes no practical difference to strength. Changing an option does not change the passwords already on screen. Click Generate to apply new settings.

Every character is chosen independently, which is what makes the entropy figures below honest. It also means a selected type can be missing from a given password, and that repeats such as aa can occur. Both are what true randomness looks like.

Entropy at common settings

Entropy in bits is length × log₂(pool size). Each extra bit doubles the number of guesses an attacker needs in the worst case. Figures below are computed from the tool's actual pool sizes:

The last row is the useful one: a long lowercase password beats a short complex one, and is easier to type on a phone or TV remote. The meter rewards character variety more than the maths does, which is why strength meters disagree with each other. We went through the reasons in password entropy explained, and you can test any existing password with the Password Strength Analyzer.

When you need a lot of passwords

Set Count up to 50 to generate a batch with the same settings, for example initial passwords for a set of test accounts or service credentials for a staging environment. Copy All puts them on the clipboard separated by newlines, ready to paste into a spreadsheet column or a script. Each password in the batch is generated independently.

What it does not do

• It does not guarantee at least one character from each ticked type. Regenerate if a site insists on one.
• There is no option to exclude look-alike characters such as 0/O or l/1/I, or to pick your own symbol list.
• It makes random-character passwords, not word-based passphrases.
• It does not save anything. Copy the password into your password manager before you leave the page.

Curious why the source of randomness matters at all? Is Math.random() random enough? shows how a non-cryptographic generator can be predicted from a handful of outputs, and how the mapping step can bias results.

Frequently asked questions

Is this password generator safe to use?

The randomness comes from crypto.getRandomValues, the browser's cryptographically secure random number generator, not Math.random. Passwords are generated on your device and are not sent, logged or stored anywhere; reloading the page discards them. As with any password, the safest place to keep it afterwards is a password manager, not a text file or a note.

How long should my password be?

For an account password you store in a password manager, 16 characters from all four character types gives about 103 bits of entropy, far beyond what any guessing attack can cover. Use 20 or more for a password manager master password or disk encryption, where an attacker can try guesses offline at very high speed. Length adds more strength than extra character types: each added character multiplies the number of possibilities by the size of the character set.

A site says my password must contain a number. Will it always have one?

No. Each character is picked independently from the combined set, so a ticked box makes that type possible, not guaranteed. With all four types at length 16, about 14.5% of passwords contain no digit at all, while missing uppercase letters or symbols is much rarer (about 0.4% each). If a site rejects a password for a missing character type, click Generate again.

Which symbols are used?

Exactly 26 of them: ! @ # $ % ^ & * ( ) _ + - = [ ] { } | ; : , . < > ? Spaces, quotes, backslashes, forward slashes, the backtick and the tilde are left out because they are the characters most often rejected by sign-up forms or mangled when pasted into a shell or config file.

How accurate is the strength meter?

It is a rough guide based only on length and the number of character types ticked. It does not analyse the generated text. Entropy is the better measure: 8 characters from all four types is about 52 bits and the meter calls it Strong, while 24 lowercase letters is about 113 bits and the meter also calls it Strong, even though it is vastly harder to guess.