Create strong, random passwords of any length — generated in your browser, never sent over the internet, with an entropy score.
Choose the length and character types, then generate. Passwords are created in your browser and are never sent over the internet.
Length and randomness. Use at least 14 random characters from a large pool (letters, numbers, symbols) and a different password for every account. A 16-character password using all four character types has about 105 bits of entropy — very strong.
The Random Password Generator creates strong, unpredictable passwords from the character types you choose. It uses your browser's cryptographically secure random number generator, picks each character without bias, and guarantees at least one character from every type you select. It then shows the password's entropy in bits and a strength rating so you can see the effect of length and character choice.
Because the passwords are generated entirely in your browser, they are never sent across the internet or stored by this website. Use a different generated password for every account and keep them in a password manager rather than reusing or memorising them.
Each extra bit of entropy doubles the number of guesses an attacker needs. Entropy is an upper bound: a password you invent yourself (a name, date or pattern) has far less real entropy than the same length randomly generated.
| Character set | 8 chars | 12 chars | 16 chars | 20 chars |
|---|---|---|---|---|
| Digits only (10 characters) | 27 | 40 | 53 | 66 |
| Lowercase letters (26 characters) | 38 | 56 | 75 | 94 |
| Lower + upper case (52 characters) | 46 | 68 | 91 | 114 |
| Letters + digits (62 characters) | 48 | 71 | 95 | 119 |
| Letters + digits + symbols (94 characters) | 52 | 79 | 105 | 131 |
| Entropy | Strength | Meaning |
|---|---|---|
| Below 28 bits | Very weak | Can be guessed almost instantly |
| 28–35 bits | Weak | Only for low-value, throwaway use |
| 36–59 bits | Reasonable | Acceptable with other protections such as rate limiting |
| 60–79 bits | Strong | Good for most online accounts |
| 80 bits and above | Very strong | Suitable for important accounts and master passwords |
| Type | Characters | Count |
|---|---|---|
| Lowercase | a–z | 26 |
| Uppercase | A–Z | 26 |
| Numbers | 0–9 | 10 |
| Symbols | ! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~ | 32 |
Yes. Passwords are generated in your browser with the secure random generator built into it (crypto.getRandomValues) and are never sent to or stored on any server. Do not use a generator that creates passwords on its server.
At least 14 characters for ordinary accounts and 16–20 or more for important ones such as email, banking and your password manager. Length adds more strength than complexity.
Entropy measures unpredictability in bits. A password with n bits of entropy takes about 2^n guesses to exhaust, so each extra bit doubles the work for an attacker. 80 bits or more is considered very strong.
Symbols enlarge the character pool and raise entropy, but length matters more. If a site rejects some symbols, untick symbols and add length instead.
Characters such as l, I, 1, O and 0 look alike in many fonts, which makes passwords easy to mistype. Excluding them helps when you must type a password by hand, at the cost of a slightly smaller pool.
It makes every character in the password unique. This slightly lowers entropy (fewer possible combinations) but can help when a system forbids repeats.
Yes. Set “How many passwords” from 1 to 20 and press Generate. Each one is created independently.
You usually should not. Store it in a reputable password manager and let it fill the password in for you; memorise only the manager's master password.
Generally yes. A random 20-letter lowercase password has about 94 bits of entropy, more than a random 12-character password using every character type (about 79 bits).
No. They exist only on your screen until you copy them or leave the page. Nothing is logged or stored by this website.
