Security

Password Generator

Generates random passwords from your browser’s cryptographic random source and reports the entropy of each.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Set the length. Length matters more than any of the other settings.
  2. Choose the character classes. Turn symbols off only if the system you are targeting rejects them.
  3. Select Generate and read the entropy figure in the summary before accepting a short password.
  4. Move the one you use into a password manager and clear the page.

What password generator does

Password strength is length multiplied by the size of the character set, expressed in bits of entropy, and length is by far the more powerful of the two. Adding one character to a twenty-character password buys more than adding an entire class of symbols does. Anything below about sixty bits should be treated as short-lived; a twenty-character mixed password is comfortably above that.

Every value is drawn from your browser’s cryptographic random source and nothing is transmitted. Be honest with yourself about the remaining risk, though: a password displayed on a screen has been displayed, and it may sit in a page still open in a tab behind you. Generate into a password manager for anything that matters, and treat what you see here as a draft unless the machine is yours alone.

Frequently asked questions

Twenty characters or more for anything that matters. Length contributes more strength than character variety does: adding one character to a long password beats adding a whole class of symbols. The summary reports the entropy so you can judge rather than guess.

No. They are generated by your browser’s cryptographic random source and never leave the page. Be aware of the risk that remains: a password shown on a screen has been shown, and may sit in a tab behind you. Move the one you use into a password manager and clear the page.

Because 0 and O, and 1 and l and I, are the pairs people mistype when reading a password off a screen or over a phone. Excluding them costs a fraction of a bit per character and removes a whole class of failed logins. Include them for anything only a machine will ever handle.