Security & accounts
Random Password Generator
Generate strong passwords using the browser's cryptographically secure random number generator, with an entropy-based strength estimate.
Excellent · 127 bit
What is Random Password Generator?
Passwords are rarely broken by someone guessing at a login form. They are broken offline: an attacker obtains a database of password hashes and tries billions of combinations per second. In that context, what matters is not whether you added an exclamation mark at the end — it is how many bits of entropy your password actually has.
This generator uses crypto.getRandomValues, the browser's cryptographically secure random source. That is a meaningful difference from the many similar pages built on Math.random, which is predictable and should never be used to generate a password.
The entropy figure shown below the password tells you how strong it is, measured in bits. Each additional bit doubles the number of guesses required. Around 80 bits is comfortably safe for personal accounts; beyond 120 bits, brute-forcing is simply not feasible with current technology.
How to use
- Drag the slider to set the length. Length has a far bigger effect on strength than adding character types.
- Tick the character sets you want. Enabling all four gives the highest entropy per character.
- Turn on the look-alike exclusion if you will ever have to read the password aloud or type it by hand.
- Click Copy and store it in a password manager straight away — not in a note or a text file.
- Click Generate new for a different password.
Frequently asked questions
Is the generated password stored anywhere?
No. It is created in your browser and never transmitted. This page has no database and logs no content. Close the tab and it is gone from memory.
How long should a password be?
For ordinary accounts, 16 characters from a full character set is plenty. For critical accounts — your primary email, banking, crypto wallets — use 24 or more. Since you store these in a password manager rather than memorise them, extra length costs you nothing.
What does entropy mean?
Entropy measures how many guesses an attacker needs on average, expressed on a base-2 logarithmic scale. A 60-bit password takes roughly 2^60 attempts. Each extra bit doubles the attacker's workload, so a 20-bit difference is a factor of a million.
Why exclude look-alike characters?
Zero and capital O, and the digit one against lowercase L and capital I, are nearly identical in many fonts. If the password only ever lives in a password manager and you always paste it, leave them in for higher entropy. If you might read or type it manually, excluding them saves frustration.