Password Generator

Generated in your browser, never sent or stored

This random password generator runs entirely on your device. The page arrives with no password in it; the first one is created only after the tool starts running in your browser. Each character is chosen with crypto.getRandomValues, the browser’s cryptographic random number generator, not Math.random. The tool keeps the results only in the page’s memory: they are not uploaded, logged, saved to local storage or put in the address bar. Reload or close the tab and they disappear.

How each character is picked

Turning a random number into “one of 90 characters” sounds simple, but the common shortcut of taking the remainder after dividing by 90 makes some characters slightly more likely than others. This tool uses rejection sampling instead: random numbers that would cause that bias are thrown away and drawn again, so every character in the pool has exactly the same chance.

When “Use at least one of each selected type” is on, the generator first draws one character from each type you checked (for example one uppercase letter, one digit and one symbol), fills the rest of the length from the whole pool, and then shuffles all positions with a Fisher–Yates shuffle. That way the required characters are not always at the start, which is a pattern attackers know to try first.

Entropy, explained simply

Entropy measures how many possibilities an attacker would have to try. For a password it is length × log2(pool size). With all four types checked the pool is 90 characters, so each character adds about 6.5 bits, and the default 16-character password has about 104 bits. For a passphrase it is words × log2(list size): this tool’s list has 976 words, so each word adds about 9.9 bits and five words give about 50 bits. Adding a number to a passphrase adds a few more bits.

The strength label follows the bits: under 40 is weak, 40–59 fair, 60–79 strong and 80 or more very strong. The time shown is how long it would take to try every combination at 10 billion guesses per second, a fast offline attack against a stolen password database. On average an attacker finds it in half that time. These numbers only hold for passwords that were generated randomly, like the ones here. A password you invented, such as a name plus a year, is much weaker than its length suggests.

Good habits that matter more than any generator

• One password per site. Passwords leaked from one site are routinely tried on others. A unique random password stops that completely.
• Use a password manager. Nobody can remember dozens of random passwords. A manager stores them encrypted and fills them in, so you only need to remember one strong master passphrase.
• Use a passphrase where you must type it. For the master password or your computer login, seven or more random words (about 70 bits) are much easier to type than 16 random characters and still far out of reach of brute force.
• Turn on two-factor authentication (2FA). An authenticator app or a security key protects the account even if a password leaks.

Need to pick names or numbers fairly instead? The random picker uses the same unbiased method. To check how long a piece of text is before you paste it somewhere with a limit, try the word counter.