Strong Password Generator
All generation happens in your browser. Nothing is uploaded.
What makes a password strong?
Password strength comes from length and randomness, not from clever substitutions like P@ssw0rd.
Attackers try common words, leaked passwords and predictable patterns first, so a truly random string is far harder to crack.
Strength is measured in bits of entropy: each extra bit doubles the number of guesses an attacker needs.
| Length | Characters used | Entropy | Verdict |
|---|---|---|---|
| 8 | a–z | ≈ 38 bits | Weak — crackable offline in minutes |
| 12 | a–z, A–Z, 0–9 | ≈ 71 bits | Strong for most accounts |
| 12 | letters, digits, symbols | ≈ 78 bits | Strong |
| 16 | a–z, A–Z, 0–9 | ≈ 95 bits | Very strong |
| 20 | letters, digits, symbols | ≈ 130 bits | Excellent — e.g. for master passwords or API secrets |
How to use this password generator
- Set the length (4–128). We recommend at least 16 characters.
- Choose character sets: lowercase, uppercase, digits and symbols. Each selected set is guaranteed to appear at least once.
- Enable exclude look-alikes if you need to read or type the password manually — it removes
O 0 o I l 1 |. - Click Generate (or press Ctrl/⌘+Enter) and copy the result. Use Generate ×5 to pick from several options.
Password security tips
- Never reuse passwords. One breached site should not unlock your other accounts.
- Use a password manager to store long random passwords — you only need to remember one.
- Turn on two-factor authentication (2FA) wherever it is available.
- For passwords you must memorise, a long passphrase of several random words is easier to remember and still strong.
Passwords are generated with crypto.getRandomValues, the browser’s cryptographically secure random number generator,
using rejection sampling so every character is equally likely. Nothing is sent over the network.
Frequently asked questions
Is this password generator safe to use?
Yes. Passwords are created locally in your browser with a cryptographically secure random generator (crypto.getRandomValues). They are never sent to a server or stored.
How long should my password be?
Use at least 12 characters for ordinary accounts and 16–20+ for important ones such as email, banking or a password manager master password.
What is password entropy?
Entropy measures unpredictability in bits: length × log2(size of the character pool). Around 70+ bits is strong; 100+ bits is extremely hard to brute-force.
Do I need symbols in my password?
Symbols add some entropy, but length matters more. A 16-character password of letters and digits is stronger than a 10-character password with symbols. Enable symbols when a site requires them.
Why exclude look-alike characters?
Characters such as O and 0 or l and 1 are easy to confuse when reading or typing a password by hand. Excluding them slightly reduces entropy, so compensate with a couple of extra characters.