Password generator
Made on your device, by the browser's cryptographic generator. Nothing is sent anywhere.
Examples temporarily replace the input and settings. You can restore your previous work.
- characters
- 20
- strength
- 125 bits
Output
•••••••••••••••••••• •••••••••••••••••••• •••••••••••••••••••• •••••••••••••••••••• ••••••••••••••••••••
Your files stay on your device
This tool runs entirely in your browser. What you paste is processed on your device and is never sent to a server, so it is safe to use with tokens, keys and unpublished text.
Example
A new account that wants 12–16 characters with a capital, a number and a symbol
A utility company’s new online account asks for 12 to 16 characters with at least one capital letter, one number and one special character. Settings: Length 16, all four kinds of character on, “Leave out look-alikes” off. The strength shows “100 bits”: 16 × log₂ 76, as 76 characters are in play.
- Each character is drawn from all 76, and a password that comes out missing a kind is drawn again, so every one of the five has a capital, a small letter, a digit and a symbol.
- Take any of the five. Throwing away the passwords that miss a kind costs less than a quarter of a bit at 16 characters, so the strength stays at 100 bits.
- If the site turns down a symbol, untick Symbols: 16 letters and digits are 95 bits, still far beyond guessing.
- Paste it into your password manager before you leave the page: the list is drawn again whenever a setting changes.
| Settings | Characters in play | Strength shown |
|---|---|---|
| 20, all four kinds (the default) | 76 | 125 bits |
| 16, all four kinds | 76 | 100 bits |
| 16, no symbols | 62 | 95 bits |
| 16, all kinds, no look-alikes | 64 | 96 bits |
| 12, all four kinds | 76 | 75 bits |
| 10, all four kinds | 76 | 62 bits |
| 20, lower case only | 26 | 94 bits |
| 8, no symbols | 62 | 48 bits |
A 16-character password of 100 bits that meets every one of the site’s rules, saved in the password manager. Note how 20 lower-case letters (94 bits) beat 10 characters of every kind (62 bits): length counts for more than variety.
How it works
- Set the length. Twenty characters is a good default for anything stored in a password manager; sixteen is plenty for most accounts.
- Choose the character sets. Turn symbols off for a site that rejects them, and turn on “Leave out look-alikes” for a password somebody has to read off a screen or a printout.
- New passwords are drawn as you change any setting — there is nothing to wait for.
- Copy the one you want, and store it in a password manager rather than in a document.
Frequently asked questions
- Where does the randomness come from?
- From crypto.getRandomValues, the browser's cryptographic generator, which is seeded by the operating system. It is not Math.random, which is predictable from a handful of outputs and has no business generating a password. The characters are also drawn without modulo bias: values that would favour the first few characters of the alphabet are discarded and drawn again.
- How long should a password be?
- Long enough that guessing it is hopeless, which today means about 12 characters minimum and 16 to 20 comfortably. The strength shown next to the length is the number of bits — 80 bits is strong, 100 bits is beyond any foreseeable attack. Length buys far more than exotic characters: a 20-character password of lower-case letters alone is stronger than a 10-character one using everything.
- What are look-alike characters?
- Capital I, lower-case l and the digit 1; capital O, lower-case o and zero; B and 8; S and 5; Z and 2. They cause no trouble when a password is copied and pasted, and endless trouble when it is read aloud, typed from a printout or entered on a TV remote. The option leaves them out at a small cost in strength, which the bits figure accounts for.
- Are the same passwords generated for everyone?
- No. Each draw is independent and comes from your device's own generator. The list also changes every time you touch a setting, so nothing you see was ever shown to anyone else.
- Does every password have a number and a symbol?
- Yes: every kind you tick is in every password. Each character is drawn from all the ticked kinds, and a password that comes out without one of them is thrown away and drawn again, so the passwords you can get are still all equally likely. That costs less than half a bit of strength at 12 characters or more. If a site turns symbols down, untick Symbols.
- Which symbols does it use?
- Fourteen: ! # $ % & * + - = ? @ ^ _ ~. No quotes, brackets, slashes, commas or spaces. If a site rejects one of them, untick Symbols and make the password a few characters longer instead: 16 letters and digits are 95 bits, 20 are 119.
- Is the password sent anywhere?
- No, and this is the one tool where that question deserves a blunt answer: a password generated on a server is a password that existed somewhere other than your machine. These are drawn in your browser, are never transmitted, and are gone when you close the page.
Related tools
• UUID Generator Create UUID v4 or v7 identifiers in bulk, generated on your device with a secure random source. # Hash Generator Get the MD5, SHA-1 or SHA-2 digest of any text, computed on your device. ∿ Base64 Convert text to Base64 and back, with correct UTF-8 handling and an optional URL-safe alphabet. ♭ JWT Decoder Paste a JSON Web Token and read its header and claims. The token never leaves your browser.