Password Generator
Generate one or more strong random passwords with the length and character classes you need, with a live strength meter and an estimated time to crack. Generated in your browser, never sent to our servers.
- Runs in your browser
- Free to use
About this tool
The Password Generator creates unpredictable passwords with the browser's cryptographic random generator and guarantees that every selected character class appears at least once. Set the length with the slider or a preset, pick the character sets, exclude look-alike characters for passwords that will be typed by hand, and read the strength meter and estimated time to crack before generating a batch.
Test an existing password with Rate My Password; the special characters reference and the htpasswd generator complete the set.
How to use it — quick steps
- 01
Set the length
Drag the slider, click a preset or type a number; 16 characters is a good default for most accounts.
- 02
Choose the character sets
Tick lowercase, uppercase, digits and symbols; exclude look-alike characters if you will type it.
- 03
Press "Generate passwords"
Read the strength meter first, then generate; every password has its own [copy] link and a [copy all] action.
Key features of this tool
Cryptographically random
Passwords come from crypto.getRandomValues() with unbiased sampling, and every chosen character set appears at least once.
Strength before you generate
The meter shows entropy and the estimated time to crack as you change the length and sets, so you can tune it.
Nothing leaves your browser
Generation runs on your device; the page makes no network request with the passwords you create.
Frequently asked questions
How strong is a 16-character password?
With all four character classes it has about 100 bits of entropy, which is far beyond what brute force can reach today. Twelve characters is a reasonable minimum and twenty or more is wise for a master password.
How is the time to crack estimated?
From the entropy, assuming a fast offline attack of 100 billion guesses per second against a weakly hashed leak. Online attacks are millions of times slower, so the real figure is usually much better.
Is it safe to generate passwords on a website?
Here, yes: the generator is JavaScript running on your device using the cryptographic random source, and the page sends nothing to our servers. Store the result in a password manager.
Which symbols are allowed where?
The Password Special Characters page lists the symbols and the systems that accept them; this generator uses a conservative set that works almost everywhere.