How to use the password generator
Drag the slider to choose a length, tick the character sets you want, and a new batch appears immediately. Each password is guaranteed to contain at least one character from every set you selected, which keeps picky sign-up forms happy. The status line shows the estimated entropy in bits, which is a far better measure of strength than any coloured bar.
Passwords are built from crypto.getRandomValues with rejection sampling, so every character in the pool has exactly the same chance of being picked. Nothing is saved, logged or sent anywhere; reload the page and they're gone.
What "bits of entropy" means
Entropy counts how many guesses an attacker would need in the worst case. Each extra bit doubles the work. A password drawn from 86 possible characters gets about 6.4 bits per character, so 20 characters gives roughly 128 bits, which is more than any attacker could brute-force with foreseeable hardware.
| Bits | Rough meaning |
|---|---|
| Under 45 | Weak. Crackable offline if the site's password database leaks. |
| 45–64 | Fair for low-value accounts with rate-limited logins. |
| 65–89 | Strong. Good for most accounts. |
| 90+ | Very strong. Use for password manager master keys, encryption and admin accounts. |
These numbers only apply to randomly generated passwords. A human-chosen password like Summer2026! has the same length as a random one but is cracked in seconds, because attackers try common patterns first.
Length beats complexity
Adding four characters increases strength more than adding symbols to a short password. If a site forbids symbols, just go longer. Current NIST guidance (SP 800-63B) agrees: it recommends allowing long passwords, dropping forced composition rules and not making people change passwords on a schedule unless there's evidence of compromise. We dig into this in how long should a password be.
Good habits
- Use a password manager so every site gets its own random password.
- Turn on two-factor authentication, ideally with a passkey or authenticator app rather than SMS.
- Use "Avoid look-alikes" for passwords you'll need to read aloud or type from paper, such as Wi-Fi keys.
Frequently asked questions
Is it safe to generate passwords on a website?
This page generates passwords locally with your browser’s secure random generator and makes no network requests while doing so. You can verify this by disconnecting from the internet and using it offline.
How long should my password be?
For accounts protected by a password manager, 16 to 20 random characters is plenty. For a master password you have to remember, consider a passphrase of five or more random words.
Why does a site reject my generated password?
Some sites still limit length or disallow certain symbols. Untick Symbols or lower the length to match their rules.