// generate strong random passwords instantly
Generate strong, random passwords with custom length, character rules, and bulk output. Entropy score, strength meter, and passphrase mode — free, no sign-up.
Choose password length with the slider, toggle character sets on or off, and apply exclusions for ambiguous characters.
A cryptographically secure password is generated instantly. The strength meter and entropy score help you gauge how secure it is.
Copy the password to clipboard, regenerate with ↻, or slide the bulk count to generate up to 50 passwords at once and download them as a file.
Password Generator uses the browser's crypto.getRandomValues API — cryptographically secure random generation — to produce passwords that are impossible to predict. Nothing is logged, stored, or sent to any server. All generation happens entirely in your browser.
Yes. This tool uses window.crypto.getRandomValues(), the browser's cryptographically secure pseudo-random number generator (CSPRNG). This is the same API used by password managers and security-critical applications. The output is indistinguishable from true randomness and cannot be predicted even if an attacker knows previous outputs.
No. All password generation happens entirely in your browser using JavaScript. No data is sent to any server, no analytics are collected on the generated values, and nothing is stored in cookies or local storage. Close the tab and the passwords are gone.
Entropy measures the unpredictability of a password in bits. Each bit of entropy doubles the number of guesses required to crack the password by brute force. A password with 60 bits of entropy requires 2⁶⁰ guesses on average. Modern hardware can make billions of guesses per second, so 80+ bits of entropy is considered strong for most purposes.
Ambiguous characters are those that look similar in many fonts: 0 and O, I and l and 1. When you need to read a password aloud or type it manually from a screen, excluding these characters prevents transcription errors without significantly reducing security for most password lengths.
Passphrase mode generates a sequence of random words separated by a delimiter, such as correct-horse-battery-staple. Passphrases are often easier to remember than random character strings while still providing excellent entropy — four common words give roughly 44 bits of entropy, and six words exceed 66 bits.
For general online accounts, 16–20 characters with mixed character types is more than sufficient. For high-value targets like email, banking, or password manager master passwords, 24+ characters or a 5–6 word passphrase provides robust protection. Since you use a password manager to store these, there is no reason not to use the maximum length a site allows.
Weak and reused passwords remain one of the most common causes of account compromise. Dictionary attacks, credential stuffing, and brute-force attacks exploit predictable patterns — names, birthdates, keyboard walks like qwerty123, or slight variations of previous passwords. A strong password must be long, random, and unique to every account. This generator creates passwords that meet all three criteria in seconds.
Many password generators on the web use Math.random(), which is a pseudo-random number generator not suitable for security applications. Its output can be predicted if an attacker observes enough values. This tool uses window.crypto.getRandomValues(), the Web Cryptography API's CSPRNG, which produces output that is computationally indistinguishable from true randomness. Every character in every password is selected using this secure source.
Different systems have different password requirements. Some corporate systems reject special characters. Some websites only allow certain symbols. The character set controls let you enable or disable uppercase letters, lowercase letters, digits, and symbols independently. The exclusion options remove ambiguous characters (useful for passwords that may be read aloud) or visually similar bracket pairs (useful for systems where some symbols cause parsing issues).
Entropy in bits is calculated as the logarithm base 2 of the total number of possible passwords: log₂(charset_size ^ length). A 20-character password using all four character sets (pool of 94 characters) has approximately 131 bits of entropy. At one trillion guesses per second — beyond the capability of any current hardware — cracking such a password would take longer than the age of the universe. The strength meter and entropy display on this tool help you see exactly where your current settings fall on that scale.
The passphrase mode generates passwords from a curated wordlist, producing outputs like violet-trumpet-cabin-frost. Passphrases have two advantages over random character strings: they are far easier to memorise, and they can be typed quickly on mobile keyboards. The security comes from the number of words and the size of the wordlist. This generator uses a 2048-word list, giving each word approximately 11 bits of entropy. Four words deliver 44 bits; six words deliver 66 bits — comparable to a strong character-based password.
The bulk generation feature lets you produce up to 50 passwords at once with the same rules, which is useful when provisioning temporary credentials for new users, generating API keys for a test environment, or creating one-time access codes. The download button exports the full list as a plain text file you can import into a spreadsheet or credential management system.