Random Password Generator
Make strong random passwords that are created only in your browser.
Random Password Generator: the tool
Settings
From 4 to 128 characters. Longer is stronger.
Up to 20.
Leaves out 0, O, o, 1, l, I and | so a password is easy to read out or retype.
Result
Choose your settings and press Generate. A password is only drawn when you ask, here in your browser.
Choose a length and the kinds of character, and get a password that no person invented and no one can guess. It is drawn on your device when you press Generate, shown once, and never stored or sent anywhere. Copy it straight into your password manager.
How it works
Every character is drawn independently from your browser's cryptographic random generator, using a method that gives each character in the pool the same chance. With all four kinds ticked the pool has 85 characters, so each position adds about 6.4 bits of unpredictability, and a 16-character password carries about 103 bits. That number is what makes a password hard to guess, far more than a clever pattern.
When you tick several kinds, such as lowercase, uppercase, digits and symbols, the generator makes sure each kind appears at least once. It does that by drawing again when a kind is missing, instead of forcing one character of each kind into fixed places, so every password that meets your rules stays equally likely and no position is predictable. For long passwords the check almost never has to repeat.
The symbol set leaves out quotes, backslashes, spaces and angle brackets, the characters that most often break a login form or a command line. The look-alike option also removes 0, O, o, 1, l, I and |, which helps when a password has to be read aloud or typed from paper. The strength shown assumes the password is random, used for one account only and kept secret.
How to use it
- Choose the length, from 4 to 128. Sixteen characters is a good start for most accounts.
- Tick the kinds of character the site you are signing up to accepts, and avoid look-alikes if you will type it by hand.
- Press Generate and check the strength line under the result.
- Copy the password into your password manager or the sign-up form. Press Generate again if you want a different one.
Example
A 16-character password with all four kinds of character, drawn with a fixed sequence so the example is repeatable. Never use an example from a web page as a real password: your own draws are different each time.
What was set
- Length
- 16 characters
- Characters
- lowercase, uppercase, digits and symbols
What came out
- Password
- $-8iJe=2T]Z99Zhd
- Strength
- very strong, about 103 bits
Good to know
- The length goes from 4 to 128 characters, and you can make up to 20 passwords at a time. The length must be at least the number of kinds you tick.
- A password is only as safe as the way it is kept. Do not reuse it, do not send it in a message, and prefer a password manager to your memory or a note on the desk.
- The tool does not remember anything. If you leave the page before copying a password, it is gone, and there is no way to get it back.
Questions people ask
Is it safe to generate a password on a website?
Here, yes, as far as a website can be: the password is created by code that runs in your browser and is never sent anywhere. You can open your browser's Network tab while you press Generate and see that no request carries it. For your most important accounts, the generator built into a good password manager is a better habit, because it also stores the result for you.
How long should a password be?
Length matters more than variety. Each extra character multiplies the number of possibilities by the size of the pool. Sixteen random characters is strong for almost any use, and twenty or more is sensible for a password manager's master password or an account you cannot afford to lose.
Why does the site I use not accept some symbols?
Some sites accept only certain symbols. Untick Symbols and make the password longer instead: a longer password made of letters and digits is at least as strong as a shorter one with symbols.
What does the strength rating mean?
It comes from the number of bits: below 40 is weak, 40 to 59 fair, 60 to 79 strong and 80 or more very strong. It measures how hard it is to guess a random password of this length and pool. It does not protect against a password being stolen, reused or typed into a fake site.
Can the password be recovered if I lose it?
No. Nothing is stored or logged, by design. Copy it before you close the page, and keep it in a password manager.