Password Generator

Generate strong random passwords locally with adjustable length, letters, numbers, symbols, exclusions, no-repeat mode, entropy, and click-to-copy.

Password Generator

Choose your settings, then select Generate password.

Password settings

Use it once. Save the password in a trusted password manager and enable phishing-resistant MFA when available. The entropy value describes the generator's search space; it is not a guarantee against compromise.

What does the Password Generator calculate?

The Password Generator converts the values you enter into a structured estimate using the formulas and assumptions documented on this page. Use the result to compare scenarios, review the calculation details, and identify sensitive inputs. Check the guide and formula sections before using the estimate for an important decision.

Password Generator at a Glance

Creates 8- to 128-character random passwords in the browser.
Uses the browser Web Crypto random source and unbiased range mapping.
Supports lowercase letters, uppercase letters, numbers, and symbols.
Can remove ambiguous characters, brackets, or every repeated character.
Displays modeled entropy, active pool size, length, and a strength label.
Copies the current password and immediately replaces it with a new one.

A Short History of Generated Passwords

Early password systems often relied on short user-chosen words. As online accounts multiplied and credential reuse became a common attack path, password managers and machine-generated secrets made long, unique passwords practical. Modern guidance emphasizes length, uniqueness, compromised-password blocklists, secure storage, and stronger authentication rather than forcing people to memorize predictable composition patterns.

What Does This Password Generator Do?

The calculator builds a character pool from the options you enable, applies the selected exclusions, and generates a password of the requested length. Every result contains at least one character from each enabled type. It also calculates the size of the valid result space and expresses that count as estimated bits of entropy.

Who Should Use It?

Anyone creating a new online account, replacing a reused password, or preparing a unique password for a password manager can use the tool. Administrators can also use it to understand how length and character-pool choices affect a random generator. Do not use it to generate cryptographic keys, recovery codes, API secrets, or other material that requires a purpose-built key-management system.

What Problems Does It Solve?

For “What Problems Does It Solve?,” the Password Generator organizes the relevant inputs, applies the documented method, and shows a result that can be compared across scenarios. The points below identify the specific considerations and assumptions users should review before relying on the estimate.

Avoids predictable names, dates, keyboard patterns, and common words.
Creates a different password for each account.
Adapts to sites that accept different lengths or character types.
Removes characters that are difficult to distinguish during manual entry.
Shows the effect of settings on the modeled random search space.

Key Benefits

Local generation: the password is created by client-side code and is not placed in the page URL.
Cryptographic source: random values come from crypto.getRandomValues.
Unbiased selection: rejection sampling prevents direct-modulo range bias.
Exact validation: impossible no-repeat requests are rejected before generation.
Safer handoff: clicking the password copies it and replaces the visible value.

Password Generator Definitions

Character pool: All characters that remain after enabled types and exclusions are applied.
Entropy estimate: The base-2 logarithm of the number of valid passwords the configured generator can produce.
Ambiguous characters: Characters such as lowercase l, uppercase I, one, uppercase O, and zero that can be confused visually.
No-repeat mode: A setting that allows each available character to appear at most once in a password.
Rejection sampling: Discarding random source values from an uneven remainder interval before mapping them to a pool index.
Password manager: Software designed to generate, store, and autofill unique account passwords in a protected vault.

When Should You Use This Generator?

Use it when a service asks you to create or replace a password and you have a secure place to save the result. Check the service's maximum length and accepted characters first. Prefer a long unique value and keep all character types enabled unless the service rejects them or manual entry makes exclusions necessary.

How Password Generation Works

For “How Password Generation Works,” the Password Generator organizes the relevant inputs, applies the documented method, and shows a result that can be compared across scenarios. The points below identify the specific considerations and assumptions users should review before relying on the estimate.

Validate the length and confirm that at least one character type is enabled.
Remove ambiguous characters and brackets when requested.
Request unsigned 32-bit values from the browser Web Crypto interface.
Map accepted source values to the filtered pool with rejection sampling.
Regenerate a candidate unless it contains every enabled character type.
Count all valid candidates and calculate the modeled entropy.

H=\log_2(V)

V is the number of valid passwords under the current settings. See the complete password entropy formula and configuration examples.

How to Choose Password Settings

Length has the largest straightforward effect on a randomly generated password's search space. Use the longest value the account accepts, keep each supported character type enabled, and exclude ambiguous characters only when you expect to read or type the password. No-repeat mode is normally unnecessary and can reduce the maximum available length.

NIST guidance tells password verifiers not to impose composition rules on user-chosen passwords. The options here are generator controls, not a claim that every account should require all four character types.

Common Password Mistakes

Reusing one strong password across several accounts.
Saving the result in an unprotected note, email, or document.
Assuming a strength label protects against phishing, malware, or account recovery attacks.
Publishing a password example or leaving it visible on a shared screen.
Using this password generator for cryptographic keys or recovery tokens.
Skipping multifactor authentication when a stronger option is available.

Frequently Asked Questions

Are generated passwords stored or sent anywhere?

No. Password generation and entropy estimation happen locally in your browser. Generated passwords are not placed in the page URL. For a useful Password Generator result, use realistic inputs, compare relevant scenarios, and review the stated assumptions before making a decision.

What password length should I choose?

Use the longest unique password the account accepts. The default is 40 random characters. NIST guidance tells password verifiers to permit a maximum password length of at least 64 characters, although individual services may apply different limits. Review the Password Generator assumptions before relying on this result for decisions.

Should I exclude ambiguous characters?

Exclude them when you may need to read or type the password manually. Keeping them increases the character pool slightly, but length and uniqueness matter more than visually confusing characters. Review the Password Generator assumptions before relying on this result for decisions.

Can I reuse a generated password?

No. Use a unique password for every account so one breach does not expose other accounts. For a useful Password Generator result, enter realistic values, compare relevant scenarios, check the calculation details, and review the definitions, assumptions, and limitations before using the estimate for an important decision.

Does the generator check whether a site accepts the password?

No. Check the account's maximum length and accepted characters before saving the result. The generator does not connect to or validate a third-party password policy. Use realistic inputs and review the Password Generator assumptions before relying on this result for decisions.

Does Very strong guarantee that a password is safe?

No. The label describes estimated random-generation entropy. Malware, phishing, password reuse, insecure storage, account recovery, and exposed clipboards can still compromise an account. For a useful Password Generator result, use realistic inputs, compare relevant scenarios, and review the stated assumptions before making a decision.

One Useful Fact About Generated Passwords

Adding length usually matters more than adding one extra symbol to a short password. For a uniform pool of N characters, each additional character adds approximately log₂(N) bits to the unrestricted random search space.

Conclusion

Create a long random password that the service accepts, use it for one account only, and save it directly in a trusted password manager. Treat entropy as a property of the generator configuration, not as a guarantee that the account or device cannot be compromised.