Random Password Generator

Strong passwords generated on your device with a cryptographically secure random number generator.

Length

A–Z

a–z

0–9

!@#$

Exclude look-alikes

How many

Passwords

Ready

Secure by design

Passwords on this page are generated with the browser's Web Crypto API (crypto.getRandomValues), the same cryptographically secure random number generator used for encryption keys. Ordinary JavaScript randomness (Math.random) is predictable and should never be used for passwords. Each character is chosen with rejection sampling, so no character is more likely than another.

Generation happens entirely on your device. The passwords are never sent to our server, never logged and never stored. Refreshing the page or clicking Generate creates new ones.

How long should a password be?

Length matters more than complexity. The strength figure shown under the output is the password's entropy: length × log₂(number of possible characters). Every extra bit doubles the number of guesses an attacker needs.

Length	Lowercase only (26)	All four types (~87)
8	38 bits	52 bits
12	56 bits	77 bits
16	75 bits	103 bits
20	94 bits	129 bits

Length

Lowercase only (26)

All four types (~87)

38 bits

52 bits

56 bits

77 bits

75 bits

103 bits

94 bits

129 bits

The U.S. National Institute of Standards and Technology (NIST) guidance in SP 800-63B-4 asks services to accept passwords of at least 64 characters and to require at least 15 characters when a password is the only login factor. A random 16 to 20 character password from this generator, stored in a password manager, is a good default for any account.

Tips for using generated passwords

Use a password manager. Random passwords are meant to be stored, not memorised. Bitwarden, 1Password, Apple Passwords and Google Password Manager all autofill them.

Use a different password for every account. Reused passwords are the main way one breach turns into many.

Turn on two-factor authentication wherever it is available, ideally with an authenticator app or passkey.

Exclude look-alikes (I, l, 1, O, 0) if you will ever need to read or type the password by hand, such as a Wi-Fi key.

If a site rejects some symbols, untick !@#$ and increase the length instead — 24 letters and digits are stronger than 12 characters with symbols.

Frequently asked questions

Is it safe to generate a password online?

Here, yes: the password is created by your own browser with a cryptographically secure generator and never leaves your device. You can even disconnect from the internet after the page loads and it still works.

What is a strong password length?

At least 15 characters for passwords used on their own, following current NIST guidance. 16 to 20 random characters from this generator gives roughly 100 bits or more of entropy.

Why does each password contain every selected type?

Many sites require at least one uppercase letter, digit and symbol. The generator keeps drawing until every selected type appears, so the password is accepted by such rules without reducing randomness in a meaningful way.

What does "bits of entropy" mean?

It measures how many guesses are needed: a password with N bits of entropy needs up to 2^N guesses. Above about 80 bits is far beyond what attackers can brute-force.

Random Password Generator

Secure by design

How long should a password be?

Tips for using generated passwords

Frequently asked questions

Related tools