Skip to content
Utilboxes

Password Generator

Set a length and the character types, or switch to a word-based passphrase, then copy the result. Passwords come from your browser's cryptographic random number generator and are never sent or stored. Aim for at least 16 characters: a 16-character password from the full character set has about 105 bits of entropy, far beyond brute force.

Runs entirely in your browser

Updated

How to use the Password Generator

  1. 1Choose between a random password and a word-based passphrase.
  2. 2Set the length and which character types to include.
  3. 3Turn on the ambiguous-character filter if you will be typing the password by hand.
  4. 4Copy the result, or generate a batch if you need several.

How it works

Randomness comes from crypto.getRandomValues(), the browser's cryptographically secure generator, which is seeded by the operating system's entropy pool. This matters: Math.random() is fast but predictable enough that an attacker who sees a few outputs can work out the rest, which makes it unsuitable for anything secret.

Characters are selected using rejection sampling rather than a simple modulo, because modulo introduces a slight bias toward the start of the character set. Rejection sampling discards values that would skew the distribution, so every character is genuinely equally likely.

The strength figure shown is entropy in bits — log₂ of the number of possible passwords of that length and character set. It measures how many guesses an attacker needs on average, and it is the honest way to compare two passwords. A 16-character password from the full set is about 105 bits, which is beyond brute force by any realistic margin.

Passphrases trade length for memorability. Four random words from a large list give roughly 52 bits — weaker than a long random string but far stronger than anything a person invents, and much easier to type on a phone.

Nothing generated here is transmitted, logged or stored. Closing the tab is the end of it.

Tips and common mistakes

  • Use a different password for every site; one leak then only affects one account.
  • Paste the password straight into a password manager rather than writing it somewhere temporary.
  • Choose 16 characters or more for anything important.
  • Turn on two-factor authentication as well, starting with your email account.

Frequently asked questions

How long should my password be?
At least 16 characters for anything important. Length contributes more to strength than complexity does — a long password from a smaller character set beats a short one with symbols.
Is this password generator safe to use?
The generation happens entirely in your browser using cryptographic randomness. Nothing is sent over the network and nothing is stored. That said, for accounts that matter, a dedicated password manager is the better tool because it also handles storage.
What does entropy mean?
The number of bits of true randomness in the password. Each extra bit doubles the guessing effort. Under 50 bits is weak, 70–80 is solid, and above 100 is well beyond brute force.
Should I use a passphrase instead?
For passwords you have to type often, or recite aloud, yes. Four or five random words are easy to remember and far stronger than a typical invented password.
What are ambiguous characters?
Pairs that look alike in many fonts: 0 and O, 1, l and I. Excluding them makes a password safer to read off a screen or a printout, at a small cost in entropy.
How long would a password take to crack?
For random passwords using all character types, against an attacker making 10 billion guesses a second: about a week to try every 8-character password, and about 1.5 million years for 12 characters.
Can I generate several passwords at once?
Yes. Generate a batch and copy the ones you need.
Should I change my passwords regularly?
Current guidance from standards bodies is to change a password when there is reason to think it was exposed, not on a fixed schedule. A long, unique password can stay as it is.
Share this toolShare on XShare on FacebookShare on LinkedInShare on RedditShare by email

Guides

Related tools

UUID GeneratorVersion 4 and version 7 UUIDs, plus NIL and ULID-style output.Random Number GeneratorPick numbers in a range, with or without repeats.QR Code GeneratorQR codes for links, text, email, phone, SMS and Wi-Fi.Base64 EncoderEncode text or a file to Base64, standard or URL-safe.Developer Tools