Password Generator

About the Password Generator

This password generator creates random passwords entirely in your browser using the Web Crypto API's crypto.getRandomValues, the same cryptographically secure random source used by security software rather than Math.random. You choose a length anywhere from 6 to 128 characters and which character sets to draw from: lowercase letters, uppercase letters, digits and a set of 27 symbols. An optional exclude-ambiguous toggle strips characters that are easy to misread, such as 0 and O, or 1, l and I.

A live entropy estimate updates as you change settings, showing the strength in bits together with a plain-language label: weak, ok, strong or overkill. Entropy is the standard way to reason about password strength. It is the base-2 logarithm of the number of possible passwords for your chosen settings, so every extra character or extra character set makes brute-forcing exponentially harder, not just a little bit harder.

Use it whenever a new account, database user, API service or Wi-Fi network needs a password and a short memorable word is not good enough. Picking a fresh random password per service is the main defense against credential-stuffing attacks, where a password leaked from one breached site gets tried against every other account you own.

Reach for exclude-ambiguous when a password has to be typed by hand, read aloud over the phone or entered on a device with an awkward on-screen keyboard. Disable symbols entirely when a system rejects special characters and compensate with extra length so the entropy stays high.

Generation and the entropy calculation both run only in your browser. The password never touches a server and is not logged anywhere, so it is safe to use for real production credentials, not just test data.

How to use it

1. Drag the length slider from 6 to 128 characters (default 20).
2. Toggle which character sets to include: lowercase, uppercase, digits and symbols.
3. Enable exclude ambiguous to drop easily confused characters like 0/O and 1/l/I.
4. Read the live entropy estimate in bits and its strength label (weak, ok, strong, overkill).
5. Click regenerate for a new password with the same settings.
6. Click copy to place the password on your clipboard.
7. Repeat as often as needed; nothing is stored between visits.

Examples

• 20 characters with all four sets enabled: u<^x5Gx!H5ve@9@YknRm, around 129 bits, labeled overkill, a good fit for a password manager entry.
• 16 characters, letters and digits only, symbols disabled: KWirscpRESI0SWw3, around 95 bits, labeled strong, useful for a Wi-Fi router admin page.
• 12 characters, ambiguous excluded, letters and digits only: CvZc3Cgvmirx, handy for a password that must be typed from a printed slip without confusing 1, l, I or 0, O.
• 32 characters with all four sets, for a high-value secret such as a root database password: 34G1-IUa@8Oa@G1A4v(mG3^ib-d]qeoY, around 207 bits.
• 8 characters, lowercase only: roughly 38 bits, weak, useful mainly to see how fast entropy drops when character sets are disabled.

How the entropy estimate is calculated

Entropy in bits equals the password length multiplied by log2 of the character pool size. This tool's pool sizes are 26 for lowercase, 26 for uppercase, 10 for digits and 26 for symbols in the entropy formula. The symbol set actually used for generation has 27 characters (!@#$%^&*()-_=+[]{};:,.<>?/~), so the true entropy with symbols enabled is marginally higher than the number shown, never lower.

• 12 characters: lowercase only 56 bits, add uppercase 68 bits, add digits 71 bits, add symbols 78 bits.
• 16 characters: lowercase only 75 bits, add uppercase 91 bits, add digits 95 bits, add symbols 103 bits.
• 20 characters (default): lowercase only 94 bits, add uppercase 114 bits, add digits 119 bits, add symbols 129 bits.
• 32 characters: lowercase only 150 bits, add uppercase 182 bits, add digits 191 bits, add symbols 207 bits.

Strength thresholds used by this tool

The live label under the password maps directly onto the bit count, using fixed thresholds rather than a sliding scale.

• 128 bits or more: overkill, far beyond what any realistic attack can brute-force.
• 80 to 127 bits: strong, the recommended range for most account passwords.
• 60 to 79 bits: ok, acceptable for lower-value or rate-limited accounts.
• Under 60 bits: weak, avoid for anything you actually care about.

Common password-generation mistakes

• Disabling symbols and digits to make a password easier to type, then keeping the same short length, which lets entropy collapse to well under 60 bits.
• Assuming exclude-ambiguous changes the entropy shown. It only shrinks the character pool used to build the password; the live bit estimate does not subtract the excluded characters.
• Reusing one generated password across multiple accounts instead of generating a fresh one per service.
• Copying the password into a chat message or note app instead of a password manager, leaving it exposed long after the clipboard is cleared.
• Choosing a length below 12 characters even with every set enabled, which still falls short of the commonly recommended 80-bit floor.

Frequently asked questions