Password Generator
Random · Cryptographically secure · Length 4–64 · Custom character sets · Free · Nothing stored
Quick presets
Character types
Password Strength Guide
| Entropy | Strength | Example use | Time to crack (offline) |
|---|---|---|---|
| < 28 bits | Very Weak | Never use | Milliseconds |
| 28–40 bits | Weak | Throwaway accounts | Minutes to hours |
| 40–60 bits | Fair | Low-value accounts | Days to months |
| 60–80 bits | Strong | Most accounts | Centuries |
| 80–100 bits | Very Strong | Financial, email | Far beyond lifetime |
| 100+ bits | Exceptional | Password manager, master keys | Computationally impossible |
Crack times assume 100 billion guesses per second (modern GPU brute force). Online attacks are throttled by the service and are orders of magnitude slower.
Password Best Practices
🔑 Unique per account
Never reuse a password. If one site is breached, all accounts with that password are at risk.
📏 Length beats complexity
A 20-character lowercase-only password has more entropy than a 10-character mixed one. Go long.
🔐 Use a password manager
You only need to remember one master password. Your manager stores unique strong passwords for every site.
📵 Never share passwords
Legitimate services will never ask for your password via email, chat, or phone.
🔄 Rotate after breaches
Check haveibeenpwned.com regularly. Change passwords for any account that appears in a known breach.
🛡️ Enable 2FA everywhere
A strong password plus two-factor authentication makes accounts almost impossible to compromise remotely.
Frequently Asked Questions
Is this password generator truly random?
Yes. Passwords are generated using the Web Cryptography API (crypto.getRandomValues), which uses the operating system's cryptographically secure pseudo-random number generator (CSPRNG). This is the same standard used by password managers and security tools — it is suitable for generating passwords you actually intend to use.
Are my passwords sent to a server?
No. All generation runs entirely in your browser using JavaScript. No password is ever transmitted over the network. You can disconnect from the internet and the generator will still work.
What does entropy mean?
Entropy measures how unpredictable a password is, in bits. Each bit of entropy doubles the number of guesses an attacker needs. 60 bits = 2^60 ≈ 1 quintillion combinations. The entropy calculation here is log₂(pool_size^length), assuming each character is chosen uniformly at random from the available pool.
Should I exclude similar-looking characters?
If you'll be typing the password manually (e.g. on a TV or another device), excluding lookalike characters (0/O, 1/l/I) reduces transcription errors. If you'll always copy-paste it, there is no reason to exclude them — a smaller pool reduces entropy.
How long should my password be?
At minimum, 12 characters with mixed types for everyday accounts. For email, banking, and password manager master passwords, use 20+ characters. If you use a password manager (recommended), use 16–32 characters — you only need to copy-paste it, so length costs you nothing.
Why generate multiple passwords at once?
Generating several options lets you pick one that is easier to mentally associate with the service, or simply to regenerate without losing previous candidates. All options are equally secure.