How to use the password generator
- A strong password is ready as soon as the page loads. Press “Copy password” to use it.
- Drag the length slider. Each extra character multiplies the number of possible passwords.
- Untick character types a website does not allow, or tick “Avoid look-alikes” if you will type the password by hand.
- Choose how many to create if you need several, for example for new staff accounts.
- Save the password in a password manager straight away; it is not kept anywhere once you leave the page.
How randomness and strength are calculated
Ordinary Math.random() is fine for games but is not designed to be unpredictable. This tool uses crypto.getRandomValues, which draws on your operating system’s secure random source. To turn a random 32-bit number into a character position without favouring some characters, it discards the few values that would cause uneven results, a method called rejection sampling. If you ask for one of each type, those characters are placed at random positions by a Fisher–Yates shuffle.
Worked example
With the default settings, 16 characters from a pool of 89, entropy is 16 × log₂(89) = 103.6 bits, rated Very strong. Even an attacker testing ten billion guesses a second would need far longer than the age of the universe on average. By contrast, 8 lowercase letters give only 37.6 bits, which the same attacker could exhaust in seconds.
What the latest guidance says
The US National Institute of Standards and Technology updated its digital identity guidelines, SP 800-63B, in 2025. It asks services to accept passwords of at least 15 characters when a password is the only sign-in factor, and at least 8 when it is combined with multi-factor authentication. It also advises against forced composition rules and routine password expiry, because people respond with predictable patterns. The UK’s National Cyber Security Centre similarly recommends long passwords, such as three random words, plus a password manager.
Entropy assumes the password is truly random. A long password you made up yourself, or one reused on several sites, can be far weaker than the number suggests.
Key features
- Cryptographically secure randomness with no bias between characters.
- Length from 4 to 128 characters and bulk generation of up to 25.
- Optional removal of look-alike characters for passwords you must read aloud or type.
- Live entropy, strength rating and estimated cracking time.
- Works offline; nothing is transmitted or saved.
Practical use cases
New accounts. Generate a unique password for every site so one data breach cannot give anyone access to the others.
Wi-Fi networks. A WPA2 or WPA3 passphrase of 20 or more characters protects against offline guessing. Pair it with the QR code generator to share it easily.
Admin and API credentials. Use 32 characters or more for service accounts and database users that people never type.