Password Generator
＋More features: generate several at once with your own rules, and check strength
Generate several at once
The length and character types come from the form above. “Exclude look-alike characters” keeps out easily confused characters such as l (lowercase L) and 1, or O (capital o) and 0.
Check the strength of a password you already have
Estimates how hard it is to guess, from the character types used and the length (what you type is processed on your device only and is never sent or stored anywhere).
Press a button and get a random password that is hard to guess, created on the spot. Everything happens inside your own device and nothing is sent anywhere. Handy when you sign up for a new service or replace an old password.
How to use
- Choose the length with the slider (recommended: 12 characters or more; 16 or more for important accounts).
- Tick the character types you want to use (adjust them to the site’s restrictions).
- One password is ready as soon as the page opens. Use “Copy”, or press “Generate another password” as many times as you like.
How it works
- Randomness comes from the browser’s built-in cryptographic random number generator (crypto.getRandomValues).
- At least one character from each selected type is included, and then the whole password is shuffled randomly.
- Strength estimate (bits) = length × log₂(number of usable characters). 80 bits or more is generally treated as safe for the time being; 16 characters with all character types gives 105 bits.
Sources and assumptions
- Strength as information entropy is the common measure used in materials such as the IPA (Information-technology Promotion Agency, Japan) guidance on passwords (in Japanese).
Assumptions and notes
- Do not reuse the same generated password across several services.
- We recommend storing it in a password manager app (or your browser’s built-in password store).
- If a service does not accept certain symbols, untick the symbols box or generate again.
Frequently asked questions
Is the generated password saved or sent anywhere?
No. Generation happens entirely inside the browser on your device, and nothing is sent to or stored on this site’s servers or anywhere else. It disappears when you close the page, so copy it and store it somewhere safe if you need it.
How many characters are safe?
In general, 12 or more characters mixing uppercase, lowercase, digits and symbols is the guideline, and 16 or more is recommended for important accounts (email, banking). Increasing the length is the single most effective step.
Isn’t a password I can remember better?
Passwords people invent tend to be easier to guess. Random generation plus storage in a password manager is the current standard approach. If you really must memorise one, joining four or more unrelated words (a passphrase) also works well.