Generate random passwords from 6 to 64 characters using your browser's cryptographic randomness, with a live strength meter and entropy estimate.
Content last reviewed
Drag the slider anywhere from 6 to 64 characters — 16 or more is the recommended minimum.
Toggle uppercase, lowercase, digits, and symbols, and optionally exclude look-alike characters.
A password is generated instantly; click it (or the Copy button) and paste it into your password manager.
Length 16 with all four character sets enabled. Every result is unique — this output is illustrative.
Input
Length 16 · uppercase, lowercase, digits, and symbols all onOutput
Kp7#vQ2!mXz9&Rt4 (about 102 bits of entropy — rated Excellent)Symbols off and look-alike exclusion on, for a code that is easy to read aloud. Illustrative output.
Input
Length 20 · uppercase, lowercase, digits · exclude I l 1 O 0Output
mR8tWq3ZuAky6vNe2Hsd (about 117 bits of entropy)Most compromised accounts are not cracked by clever math — they are opened with passwords that were reused, guessed, or leaked from another site. The strongest habit against that is a long, random, unique password for every account, and generating one should take seconds. This generator creates one the moment the page loads and regenerates instantly whenever you change a setting.
You control the recipe: a length slider from 6 to 64 characters and independent toggles for uppercase letters, lowercase letters, digits, and symbols. An extra option excludes the look-alike characters I, l, 1, O, and 0 for passwords you may need to read aloud or retype from paper. The generator guarantees that every character set you enable actually appears in the result, so a site demanding "at least one number and one symbol" will not bounce it back.
Alongside the password you get an honest strength readout: an entropy estimate in bits, calculated from the length and the size of your character pool, mapped to a five-step meter from Very weak to Excellent. Passwords are produced by your browser's cryptographically secure random number generator and never leave your device — nothing is transmitted, logged, or stored.
A password is generated automatically when the tool loads. Adjust the Length slider (6–64) — the password regenerates as soon as you release it.
Toggle the four character sets — Uppercase A–Z, Lowercase a–z, Digits 0–9, and Symbols !@# — to match the site's requirements. At least one set must stay on.
Optionally enable Exclude look-alikes to drop I, l, 1, O, and 0, which is useful for passwords that will be read aloud or typed from paper.
Watch the strength meter and the entropy figure in the sidebar; aim for at least the Strong band (roughly 70+ bits) for online accounts.
Click the password itself or the Copy button to copy it, then paste it straight into your password manager. Click Regenerate any time you want a fresh one.
Characters are picked using the browser's crypto.getRandomValues, not a predictable pseudo-random function.
A slider covers everything from short PINs-adjacent codes to long passphrase-strength strings, with 16 marked as the recommended minimum.
Every character set you enable is represented in the output, so passwords pass at-least-one-digit and at-least-one-symbol rules.
An estimate in bits (length × log2 of the pool size) drives a five-step meter from Very weak to Excellent.
One switch removes I, l, 1, O, and 0 to prevent transcription mistakes.
Changing any setting produces a new password immediately; a Regenerate button gives you a fresh one on demand.
Create a unique, strong password for each new account instead of reusing an old one.
Replace a leaked or reused password quickly after a data-breach notification.
Generate a long passphrase for your router — enable the look-alike exclusion so guests can type it from paper.
Produce strong credentials for team tools and store them in a shared password manager.
Fill development and staging systems with random values instead of predictable placeholders.
When you generate, the tool builds a character pool from the sets you enabled (minus the look-alikes if excluded), then asks the browser's cryptographically secure random number generator for one random value per character and maps each value onto the pool. As a final step it verifies that every enabled set appears at least once in the result, substituting a character where needed so the password satisfies common site rules.
The strength estimate is length × log2(pool size) bits — a standard way to express how many guesses an attacker would need on average. Sixteen characters drawn from all four sets (a pool of 83 characters) gives roughly 100 bits, which is far beyond practical brute-force reach. The meter bands are: below 28 bits Very weak, 28–49 Weak, 50–69 Fair, 70–99 Strong, and 100+ Excellent. The estimate assumes the attacker must brute-force the full pool; it is a property of the settings, not a judgment of any specific string.
6 to 64 characters. Length is the single biggest factor in strength — prefer 16 or more.
Four independent toggles build the character pool. Symbols draw from !@#$%^&*()-_=+[]{}<>?.
Removes I, l, 1, O, and 0 from the pool so the password cannot be misread.
Produces a fresh password with the current settings at any time.
All four set toggles are off, leaving nothing to build a password from. Re-enable at least one set.
Some sites cap password length or forbid specific symbols. Shorten the slider or switch symbols off and regenerate — with enough length, a letters-and-digits password is still strong.
Clipboard access can be blocked in some embedded browsers or by permissions. Select the password text manually and copy it with your keyboard.
The tool produces random character strings, not memorable word-based passphrases. The entropy figure is an estimate based on your settings and assumes an attacker brute-forces the whole pool — it cannot account for a site truncating or mishandling the password after you set it. Maximum length is 64 characters. Guaranteeing one character from each enabled set slightly constrains pure randomness, a standard trade-off for meeting site composition rules. The generator cannot check whether a password has appeared in a breach; a password manager or breach-checking service covers that.
Passwords are generated entirely on your device using the browser's built-in cryptographic random number generator. Nothing is sent over the network, nothing is logged, and the tool keeps no history — once you leave the page, the password exists only where you pasted it.
Length beats complexity: a 20-character letters-and-digits password is stronger than 12 characters with every symbol enabled.
Store generated passwords in a reputable password manager rather than trying to memorize them.
Use a unique password per account so one breach cannot unlock the others.
Enable the look-alike exclusion for anything you will read aloud or type from paper.
Turn on two-factor authentication where offered — a strong password is one layer, not the whole defense.
Generate the password at the moment you need it, copy it, and paste it directly into the sign-up form and your password manager in the same sitting — do not park it in a note, chat, or email "temporarily." Those copies outlive their purpose.
Match the settings to the destination. For a password manager entry no human will ever type, maximize length and keep all sets on. For a Wi-Fi passphrase or anything typed from paper, prefer extra length over symbols and exclude look-alikes.
Afterward, replace rather than repair: when a service reports a breach, generate a completely new password instead of tweaking the old one. Attackers try known passwords with small mutations first.
Randomness comes from crypto.getRandomValues filling a typed array, with each value mapped onto the selected character pool — no Math.random anywhere in the generation path. A post-pass ensures each enabled set is represented, substituting at a random position if a set is missing. The entropy readout is computed as length × log2(pool size) and drives the five-band meter (thresholds at 28, 50, 70, and 100 bits). The component runs fully client-side; the password appears only in page state and your clipboard when you copy it.
| Settings | Approx. entropy | Meter rating |
|---|---|---|
| 8 chars, lowercase only | ~38 bits | Weak |
| 12 chars, letters + digits | ~71 bits | Strong |
| 16 chars, all four sets | ~102 bits | Excellent |
| 24 chars, letters + digits | ~143 bits | Excellent |
Entropy grows linearly with length but only logarithmically with pool size — which is why adding characters helps more than adding symbol variety.
Anyone opening a new account or resetting a compromised one; IT staff issuing credentials for team tools; developers needing random secrets for test environments; and households setting up router passphrases. If you already use a password manager with a built-in generator, this tool is a quick alternative for devices or moments where the manager is not at hand.
Yes — this generator runs entirely on your device and uses the browser's cryptographically secure random number generator. The password is never transmitted or stored by the tool; it exists only on the page and in your clipboard after you copy it.
Sixteen characters is a sensible minimum for anything important, and longer is better. With all four character sets enabled, 16 characters gives roughly 100 bits of entropy, which comfortably resists offline cracking.
It estimates the password's unpredictability in bits, computed from its length and the size of the character pool. Each additional bit doubles the average number of guesses an attacker needs; 70+ bits rates Strong on the meter and 100+ Excellent.
Yes. The generator checks that every character set you enabled actually appears in the result and substitutes one in if needed, so composition rules like one uppercase, one digit, one symbol are met.
It removes the characters I, l, 1, O, and 0, which are easily confused in many fonts. Use it for passwords that will be printed, read aloud, or typed from memory of a written note — a slightly smaller pool, offset by fewer transcription errors.
Because breaches happen at the service, not at your keyboard. When one site leaks, attackers replay the leaked password everywhere else (credential stuffing). Unique passwords confine any breach to the single account it came from.