Strong random password generator
This password generator creates a strong, random password in your browser the moment the page opens, with no confusing look-alike characters.
Last updated
Your text stays in your browser. Nothing you paste is uploaded or stored.
How to use the password generator
- A new 16-character password appears as soon as the page loads.
- Move the length slider to choose anything from 6 to 64 characters. A fresh password is made each time.
- Untick Include symbols if a website doesn't accept them.
- Press Copy, paste the password into the website, and save it in your password manager.
- Press Generate new password whenever you want a different one.
How the password generator works
Passwords are created with crypto.getRandomValues, the browser's cryptographically secure random number generator, which is the same kind of source used for encryption keys. Ordinary random functions such as Math.random are predictable and are never used.
Each password contains at least one lowercase letter, one capital and one digit, plus a symbol when symbols are on, because many sites require that mix. The characters 0, O, 1, l and I are left out so the password is easy to read and type. Passwords are made on your device and are never sent or stored.
Formula
Strength in bits = length × log₂(alphabet size). Without look-alikes the alphabet has 25 lowercase letters, 24 capitals and 8 digits, 57 characters in all, or 80 with the 23 symbols.
Each character is picked with rejection sampling, so every character is exactly as likely as any other, and the result is then shuffled.
Example
A 16-character password with symbols has 16 × log₂(80), about 101 bits of strength. A computer guessing a trillion passwords a second would need longer than the age of the universe to try every combination.
Without symbols, the same length gives 16 × log₂(57), about 93 bits, which is still very strong. A 12-character password with symbols has about 76 bits.
Tips and common mistakes
Let a password manager remember them
Strong passwords are hard to memorise, so store them in a password manager. You then only need to remember one master password.
Never reuse a password
When one site leaks passwords, attackers try them on other sites. A unique password for every account stops that.
Length beats complexity
Each extra character multiplies the number of possibilities. Making a password longer is the simplest way to make it stronger.
Turn on two-step verification
A second factor, such as an authenticator app, protects you even if a password is stolen.
Secrets in code and config
Encoding a secret doesn't hide it, as our Base64 encoder page explains. After pasting generated keys into a settings file, check it is still valid with the JSON formatter.
Frequently asked questions
Is it safe to generate a password online?
Here, yes. The password is created in your browser with a secure random generator and is never sent over the internet or saved.
How long should my password be?
At least 12 characters, and 16 or more for important accounts such as email and banking.
Why are some characters never used?
0 and O, and 1, l and I look alike in many fonts. Leaving them out avoids typing mistakes while barely affecting strength.
Can I make several passwords?
Yes. Press Generate new password as often as you like; each one is independent of the last.