Password Generator

About password generation

A password is only as good as the randomness behind it. These are drawn from your browser's cryptographic random number generator — the same source used for encryption keys — not from the ordinary random function, which is predictable enough to be reconstructed. Strength is reported in bits of entropy: each extra bit doubles the work needed to guess the password.

A memorable alternative to a string of random characters is a passphrase: several random dictionary words strung together, like correct-horse-battery-staple. Four to six words drawn from a large-enough wordlist reach comparable entropy to a shorter random string while being genuinely easier to type and recall, which is why some password managers offer passphrase generation alongside character-based generation like this tool's. Whichever form you use, a unique password per account, kept in a password manager rather than memorized or reused, remains the actual security-relevant decision — the character set is a secondary concern next to that.

Where you'll run into it

• Creating a unique password for each account in a password manager
• Setting a database, service, or admin account password
• Generating API keys, tokens, or seeds for a test environment
• Replacing a password after a breach notification

Frequently asked

Are these passwords sent to your server?
No, and that is deliberate. This tool has no server endpoint at all — the generation happens in your browser, so the password exists only on your device. Nothing is transmitted, logged, or stored.

How long should a password be?
For anything that matters, aim for 16 characters or more with mixed character sets, which lands comfortably above 80 bits. Length helps more than exotic symbols: adding characters raises the difficulty far faster than swapping a letter for punctuation.

Why exclude look-alike characters?
Capital I, lowercase l, the digit 1, capital O and the digit 0 are hard to tell apart in many fonts. Excluding them helps when a password must be read aloud, copied by hand, or typed from a printout — at the cost of slightly less entropy per character.

Is a passphrase like "correct-horse-battery-staple" better than a random string?
Neither is inherently better — what matters is total entropy. A passphrase of four to six words drawn from a large wordlist can reach similar entropy to a 12-16 character random string, while being noticeably easier to type and remember. This tool generates character-based passwords rather than passphrases; if you'd rather use one, the key requirement is drawing each word independently at random from a large list, not just stringing together words you already find memorable.