Password Generator
Strong random passwords from your browser's crypto source.
Everything runs inside your browser. Your files never leave your device.
Result
Ask about Password Generator
Questions about what this tool does, which option to pick, or what it can and cannot handle.
The question you type here is sent to an AI provider to be answered — your files and whatever you put in the tool above are not, and the assistant cannot see them. Answers are generated and can be wrong. The tool itself is not guessing: it runs deterministic code on your device.
About the Password Generator
A password's strength is not about looking complicated. It is about how many equally likely possibilities an attacker has to work through, and the only two things that move that number are the size of the character set and the length.
This generator draws from your browser's cryptographically secure random source, the same one that produces keys and session tokens. That distinction matters more than it sounds. The ordinary random function most code reaches for is predictable given enough output — perfectly adequate for shuffling a list, entirely unsuitable for anything an adversary is trying to guess.
You choose the length and which character sets to include, and the tool reports the resulting entropy in bits. That figure is the honest measure: each additional bit doubles the work. Around 60 bits resists a determined offline attack on a well-hashed password; above 80 bits the arithmetic stops being interesting to anyone. Length contributes far more than symbol variety does, which is why a long password of lowercase letters beats a short one with punctuation scattered through it.
There is an option to exclude look-alike characters — zero against capital O, one against lowercase l against capital I. Turn it on when the password will be read aloud, copied by hand or typed from a printout, and leave it off when it goes straight into a password manager, since removing characters shrinks the pool slightly.
The best password is one you never see. Generate it, paste it into a manager, and let the manager type it from then on. The reason to use a generator at all is that human-chosen passwords cluster hard around a small set of predictable patterns, and attackers have known those patterns for twenty years.
How to use it
- 1Set the length. Sixteen characters is a sound default; twenty or more for anything that matters.
- 2Choose the character sets to draw from. More sets widen the pool, though length matters more.
- 3Switch on “exclude similar characters” only if a person will have to read or retype this.
- 4Copy the result straight into your password manager rather than anywhere it might be saved as a note.
Questions
- Are these passwords generated on your server?
- There is no server involved. Randomness comes from your browser's own secure generator, in this tab, which is why the page still produces passwords with the network disconnected. Nothing generated here is transmitted or recorded anywhere.
- How long should a password be?
- Sixteen characters for ordinary accounts, twenty or more for a password manager's master password or anything protecting money or infrastructure. Length is the cheapest strength you can buy — it costs nothing when a manager does the typing.
- Are symbols necessary?
- Helpful but overrated. Adding punctuation widens the pool from 62 characters to about 95, which is worth roughly six extra bits on a sixteen-character password. Adding two more characters of length is worth about twelve. Prefer length when a site's rules force a choice.
- Is a random string better than a passphrase?
- Per character, yes; in practice it depends on whether you have to remember it. Four random dictionary words carry around 52 bits and can be memorised, which is the right trade for the handful of passwords you must type from memory. Everything else should be random and stored.