Password Generator
Made by your browser, never sent anywhere, never stored.
Not saved anywhere. Leave the page and it is gone.
How to use
- Set the length and tick the kinds of character you want.
- Generate makes a new one; copy takes it to the clipboard.
- Turn off look-alikes when the password will be read off a screen or written down.
Examples
A new account
Sixteen characters from all four kinds is about 102 bits of entropy — far past anything that gets guessed. Longer costs you nothing here.
A password someone has to type
Wi-Fi keys and shared logins get read aloud or copied from a sticky note. Dropping 0/O and 1/l/I removes the usual transcription mistakes.
A form that refuses symbols
Some systems still reject punctuation. Switch symbols off and add length instead: letters and digits at 20 characters beat a short password with a flourish.
Checking a file instead of a password
Hashing is the other direction and a different tool. Hash Generator
FAQ
Where does the randomness come from?
crypto.getRandomValues, the browser’s cryptographic random source. Math.random is not used anywhere: it is predictable enough that a generated password would be guessable from a few earlier ones.
Is the password sent anywhere?
No. It is made in the page, shown once and never stored — no history, no local storage, no server. Reloading loses it, which is the point.
What does the entropy number mean?
It is the length multiplied by log2 of the alphabet size — how many bits of guessing an attacker faces if they know exactly which options you ticked. Forcing one character of each kind trims it very slightly; the figure shown is the alphabet estimate.
Why is every kind guaranteed to appear?
Because most password fields demand it. The required characters are placed first and the whole password is then shuffled, so no position is predictable — a generator that always starts with a capital gives an attacker a free character.
Which characters are "look-alikes"?
Zero against capital O, and the digit one against lowercase L and capital i. Excluding them costs about a tenth of a bit per character — 1.4 bits over a 16-character password — and saves a support call.
How long should a password be?
Long enough that length does the work rather than cleverness. With all four kinds, 16 characters is comfortable and 20 or more is better for anything that matters. A password manager removes the reason to keep it short.