Security
Random Strong Password Generator Online
Create strong random passwords with adjustable length and character types.
Runs entirely in your browser — nothing you paste is uploaded or stored.
What is password generator?
A password generator produces a string of random characters that is hard to guess and hard to brute-force, unlike passwords people choose themselves, which tend to reuse patterns an attacker can exploit. This tool draws characters using your browser's cryptographically secure random number generator (the same primitive behind TLS and UUIDs), lets you choose which character types to include, and shows an entropy estimate so "strong" is not just a label — you can see the number behind it.
When to use it
- Creating a new password for an account, especially one you will store in a password manager rather than memorise.
- Generating a database user password, API key, or other service credential outside of any browser signup form.
- Setting a temporary password to hand off to a teammate or a new hire, which they will change on first login.
- Provisioning several accounts at once using the batch generator, for example when setting up a set of test or staging users.
How to use this tool
- Drag the length slider to the size you want — longer is stronger, and most modern systems accept 20+ characters.
- Toggle which character types to include — uppercase, lowercase, numbers and symbols — and optionally exclude visually ambiguous characters like 0/O and 1/l/I.
- Press Generate for a new password, or use the batch section to create several at once.
- Copy the password with the button beside it — nothing is transmitted anywhere, and nothing is stored once you leave the page.
Example
A 20-character password using every character type.
Input
length 20, all character types enabledOutput
xQ7!fL2$vN9@rT4#wZ1&This example has roughly 131 bits of entropy — far beyond what any brute-force attack can reach with current or foreseeable computing power.
A random password is only as safe as where it’s stored
Generating a strong password is half the job — the other half is not undermining it afterwards. Avoid reusing it across sites, avoid emailing it in plain text, and avoid storing it in an unencrypted note. A password manager handles all three automatically.
Storing a password you didn’t generate for yourself
Everything above is about generating a password for a person to use. If you’re building the login system that stores other people’s passwords, never save one as plain text or run it through a fast general-purpose digest — use a deliberately slow, salted algorithm built for exactly this, like the Bcrypt Generator.
Frequently asked questions
How does this tool generate randomness?
It uses `crypto.getRandomValues`, the Web Crypto API's cryptographically secure random number generator, the same primitive browsers use for generating TLS session keys. This is a different, much stronger source than `Math.random()`, which is not designed to be unpredictable and should never be used for anything security-related.
What does "bits of entropy" mean, and how much do I need?
Entropy measures how many guesses an attacker would need in the worst case — each additional bit doubles that number. 40 bits is crackable within hours on consumer hardware; 60 bits takes a well-resourced attacker a long time; 80+ bits is beyond any realistic brute-force attack, online or offline. Length matters more than complexity — a longer password from a smaller character set often beats a shorter one stuffed with symbols.
Is it safe to generate a password for something important in a browser tool?
Yes, provided the randomness is generated locally and never transmitted — which is the case here. The password is created and displayed entirely in your browser using the Web Crypto API; nothing you generate is sent to a server, logged, or stored. Still, treat any password shown on screen as visible — generate it somewhere private if that matters for your situation.
Why exclude ambiguous characters?
Characters like `0`/`O` or `1`/`l`/`I` are easy to mistype or misread, particularly when a password is read aloud, written on paper, or displayed in a font that doesn't distinguish them clearly. Excluding them trades a small amount of entropy for fewer failed login attempts — usually worth it for a password you'll ever need to type manually.
Should I use a password manager instead of memorising this?
Yes, for anything beyond a handful of accounts. A random password like the ones this tool generates is specifically designed to be too complex to memorise — that's what makes it strong. A password manager stores it securely and autofills it, so you never need to remember or retype it.
Find these tools useful? A coffee helps keep them free and ad-light.
Buy me a coffee