A new password-manager entry
Create a long, unique value for one account and save it with that account's record.
Use all four sets at 20+ characters unless the site states a smaller limit.
Free browser tool
Text & Writing
Password Generator
Generate random passwords from 6 to 64 characters using your browser's cryptographic randomness, with a live strength meter and entropy estimate.
- Free public tool
- No sign-up for this tool
- Processing clearly labeled
- Instant results
Content last reviewed
616 = recommended minimum64
Overview
Randomness, length, and a password you use only once
Choose the character sets a site accepts, set a length from 6 to 64, and generate in this browser. The result includes every enabled set, while the meter explains the settings without pretending to judge the security of the account around them.
Browser cryptographic source
Generation starts with crypto.getRandomValues rather than Math.random, and no generated value is requested from a server.
Length from 6 to 64
The slider changes the result immediately. Sixteen is marked as the recommended minimum in the interface, not imposed as a universal rule.
Four selectable sets
Uppercase, lowercase, digits and 21 symbols can be enabled independently; at least one set must remain on.
An explained estimate
The meter displays length × log2(pool size), rounded to whole bits, with visible thresholds at 28, 50, 70 and 100 bits.
How it works
Using Password Generator, start to finish
Three steps, in the order the tool above actually takes them.
- 1
Set the length
Start with the longest value the destination accepts; the control allows any whole number from 6 through 64.
- 2
Match the policy
Keep only the required character sets and exclude I, l, 1, O and 0 when the password must be read or retyped.
- 3
Generate and store
Regenerate until ready, copy once, and place the result in a password manager rather than reusing it elsewhere.
Use cases
What people bring here
The jobs this page is usually opened for, and the setting that makes each one quick.
A strict composition form
Meet an older policy that insists on uppercase, lowercase, a number and a symbol.
Leave the four sets enabled; the final check makes sure each selected set appears.
A code someone must retype
Reduce transcription mistakes for a printed setup sheet or a password read over a call.
Turn on Exclude look-alikes, then compensate for the smaller pool with more length.
Strength without theatre
What the meter can tell you — and what it cannot
A settings-based entropy estimate is useful for comparing two generator configurations. It is not a breach check, a crack-time promise or proof that the password was stored safely after it left this page.
| Signal | The tempting conclusion | The useful reading |
|---|---|---|
| More characters | A long password makes every account safe. | Length expands the search space, but cannot prevent phishing, malware, a weak password hash or account recovery abuse. |
| More character sets | Symbols automatically matter more than letters. | A larger pool adds possibilities; several extra random characters usually add more than swapping one letter for one symbol. |
| The entropy figure | This exact password has that many measured bits of entropy. | It is the theoretical length × log2(pool size) figure for the selected settings, rounded for display. |
| The Excellent badge | The password has been checked against breach lists and site rules. | The badge means the estimate reached 100 bits. The page neither queries breach data nor knows the destination's policy. |
| A unique result | It is fine to paste the same generated string into several accounts. | Uniqueness per account limits one service breach to that service; store separate results in a password manager. |
More characters
A long password makes every account safe.
Length expands the search space, but cannot prevent phishing, malware, a weak password hash or account recovery abuse.
More character sets
Symbols automatically matter more than letters.
A larger pool adds possibilities; several extra random characters usually add more than swapping one letter for one symbol.
The entropy figure
This exact password has that many measured bits of entropy.
It is the theoretical length × log2(pool size) figure for the selected settings, rounded for display.
The Excellent badge
The password has been checked against breach lists and site rules.
The badge means the estimate reached 100 bits. The page neither queries breach data nor knows the destination's policy.
A unique result
It is fine to paste the same generated string into several accounts.
Uniqueness per account limits one service breach to that service; store separate results in a password manager.
Privacy
Where your work is processed
The password is generated and scored in this tab. It is not uploaded, checked against a remote breach list or autosaved; it reaches the system clipboard only when you choose Copy.
Your text is never sent
Every result on these pages is computed by JavaScript in this tab as you type. There is no submit step and no request that carries a word of what you entered.
Your content is not autosaved
No source text, generated password or result is written to localStorage or sessionStorage. Split-view tools remember only the divider position for the current tab session; reloading clears the work itself.
The page records one aggregate view
The page shell records that this tool was opened, sending its slug and nothing from the form. It is skipped when your browser signals Do Not Track or Global Privacy Control.
One caveat on that
The endpoint behind the counter is rate-limited like any other, which briefly records a requesting address to enforce the limit. It is never joined to anything you typed, because none of that is sent.
More detail in how processing works and our privacy policy.
Limits
The generator's actual boundaries
The values this tool actually enforces, not a rounded-up version.
- Length
- 6–64
- Whole characters selected with the slider; the initial value is 16.
- Full pool
- 83 characters
- 26 uppercase + 26 lowercase + 10 digits + 21 listed symbols.
- Look-alikes
- 5 removed
- I, l, 1, O and 0 are removed from whichever enabled set contains them.
- Random source
- Uint32Array
- One crypto.getRandomValues buffer entry is requested for each output position.
- Set coverage
- Every enabled set
- A post-pass substitutes a character when an enabled set did not appear naturally.
- Strong band
- 70–99 bits
- The next display band, Excellent, begins at a rounded estimate of 100 bits.
- Persistence
- None
- The result stays in component memory until the page reloads; Copy writes it to the clipboard only on request.
- Account checks
- Not performed
- No breach lookup, policy test, password-hash test or reuse detection is attempted.
A meter cannot see reuse, phishing, or a breached service
The tool produces random character strings, not memorable word-based passphrases. The entropy figure is an estimate based on your settings and assumes an attacker brute-forces the whole pool — it cannot account for a site truncating or mishandling the password after you set it. Maximum length is 64 characters. Guaranteeing one character from each enabled set slightly constrains pure randomness, a standard trade-off for meeting site composition rules. The generator cannot check whether a password has appeared in a breach; a password manager or breach-checking service covers that.
FAQ
Password generation questions
The ones that actually come up.
Guides