How it works
This generator builds each password one character at a time from a pool you control. The four checkboxes decide which sets go into that pool: uppercase (A–Z), lowercase (a–z), digits (0–9) and symbols (!@#$%^&*()-_=+[]{};:,.<>?/), and the length slider sets how many characters to draw, from 6 up to 64. Every character is chosen with the browser's crypto.getRandomValues, a cryptographically secure source, using rejection sampling so no character is even slightly more likely than another.
To use it: set the length, pick your sets, and read the result. Regenerate draws a fresh password, Copy puts it on your clipboard, and the 5/10 passwords buttons produce a batch to choose from. The Avoid ambiguous option removes the easily-confused glyphs I l 1 O 0 so a password stays readable when typed by hand, useful for a Wi-Fi key or a printed setup code.
Reading the strength meter
The number beside the meter is entropy in bits: the base-2 logarithm of how many passwords your current settings could produce, so each added bit doubles the guessing effort an attacker faces. The tool labels the result Weak below 40 bits, Fair at 40–59, Strong at 60–79 and Excellent at 80 or more, with the bar filling toward a 100-bit reference. Aim for 60+ bits for everyday accounts and 80+ for high-value ones such as email, admin or recovery accounts. Because these strings are random, don't try to memorise them, store the result in a password manager.
Length beats complexity: bits per character
Entropy is simply length × bits-per-character, and bits-per-character depends only on how large your pool is. Adding one character multiplies the possibilities by the whole pool size, which is why length raises entropy far faster than adding exotic symbols to a short password.
| Character sets enabled | Pool size | Bits per character |
|---|---|---|
| Lowercase only (or uppercase only) | 26 | 4.70 |
| Upper + lower | 52 | 5.70 |
| Letters + digits | 62 | 5.95 |
| All four, ambiguous removed | 83 | 6.38 |
| All four sets | 88 | 6.46 |
With all four sets (6.46 bits/char), a 12-character password is about 78 bits and a 16-character one about 103 bits. A long passphrase of random words reaches the same entropy while staying memorable, a good fit for the few secrets you must type from memory. Whatever you generate, use a unique password per site so one breach can't unlock the rest.
Frequently asked questions
How long should my password be?
For a password stored in a manager, 16–20 random characters with all sets enabled is comfortably in the Excellent band and future-proof. There's no penalty for going longer, so if a site allows it, longer is always safer. Reserve shorter passwords only for cases where you must type them by hand.
Are these passwords truly random and safe to use?
Yes. They come from crypto.getRandomValues, the browser's cryptographically secure generator, not the predictable Math.random. Rejection sampling removes the subtle bias plain modulo arithmetic would introduce, so every character in the pool is equally likely.
Should I turn symbols on or off?
Leave them on when you can, they enlarge the pool and add roughly 0.5 bits per character over letters and digits alone. Turn them off only for systems that reject certain symbols, and compensate by adding a few characters of length, which recovers the lost entropy.
What does "avoid ambiguous" actually change?
It removes the characters I l 1 O 0 from the pool so the password is easier to read and re-type without errors. This slightly shrinks the pool (for example from 88 to 83 characters with all sets on), which trims entropy a little, the meter updates to reflect it.
Do I need a different password for every account?
Yes. Reuse is the single biggest practical risk: if one site is breached, attackers replay that password everywhere else (credential stuffing). Generate a fresh, unique password per account and let a password manager remember them.