How to use the password generator
- Choose a length with the slider. 16 characters is a sensible minimum for important accounts; 20 or more is better.
- Pick the character types to include. Leave all four on unless a website restricts which characters you may use.
- Tick Exclude look-alikes if you will need to read or type the password by hand.
- Click Copy and paste the password straight into your password manager or the sign-up form. Click the refresh button for a new one, or generate a whole list at once.
Every password is created on your device using the browser's cryptographically secure random number generator (crypto.getRandomValues), with unbiased selection and at least one character from each type you choose. Nothing is sent to our server, logged or stored.
What makes a password strong?
Strength comes from unpredictability, measured in bits of entropy: length × log₂(number of possible characters). Each extra bit doubles the number of guesses an attacker needs. A random 20-character password drawn from about 90 characters has roughly 130 bits of entropy, far beyond what any attacker can brute-force. A human-chosen password like Summer2025! has far less real entropy than its length suggests, because attackers try dictionary words, names, dates and common substitutions first.
| Entropy | Rating | Typical use |
|---|---|---|
| Under 36 bits | Weak | Short PINs; easily guessed offline |
| 36–60 bits | Fair | Only where login attempts are rate-limited |
| 60–80 bits | Strong | Everyday online accounts |
| 80+ bits | Very strong | Email, banking, password-manager master passwords, encryption keys |
The crack-time estimate assumes an offline attack testing 100 billion guesses per second against a fast hash. Real-world times vary with the hashing algorithm the website uses.
Password best practices
- Use a unique password for every account. Reused passwords are how one data breach becomes many hacked accounts ("credential stuffing").
- Use a password manager to generate and remember them; then you only need one strong master password.
- Turn on two-factor authentication (an authenticator app or passkey) wherever possible. It protects you even if a password leaks.
- Prefer passkeys where sites offer them: they are phishing-resistant and replace passwords entirely.
- Never send passwords by email or chat, and be wary of emails asking you to "confirm" a password. Check suspicious messages with our phishing email analyzer.
Developers storing passwords should never use a plain fast hash; see why in our hash generator guide. Need random identifiers rather than secrets? Use the UUID generator.
Frequently asked questions
Is it safe to generate a password on a website?
Here, yes: the password is generated by JavaScript in your browser and never transmitted. You can even disconnect from the internet after the page loads and it will keep working.
How long should my password be?
Current guidance, such as NIST SP 800-63B, emphasises length over complexity rules. For random passwords, 16+ characters is strong for most accounts; use 20+ for your email and password manager.
Why exclude look-alike characters?
Characters such as 0/O and 1/l/I are easy to confuse when reading a password aloud or typing it from paper. Excluding them slightly reduces entropy, so add a character or two to compensate.
Should I change my passwords regularly?
Not on a fixed schedule. Change a password when there is evidence it may be compromised, for example after a breach notification.