Password Generator_
A strong password generator with honest math: pick a length, choose character sets, and get a cryptographically secure random password — plus the entropy in bits, computed from the exact character pool you selected, so you can see precisely what each option costs or buys.
No account, no vault upsell, and generation is provably local: the password is assembled by JavaScript on this page, never sent, never stored — the tool keeps working with your network unplugged.
What a password generator does — and how to judge one
What is a password generator?
A password generator is a tool that assembles a random string from a pool of characters — here, up to 90 of them: 26 lowercase, 26 uppercase, 10 digits, and 28 symbols. What makes a password generator random in the sense that matters is uniformity and independence: every character drawn with equal probability from the pool, every position independent of the others. This page draws each character from your browser's cryptographically secure generator (crypto.getRandomValues) using rejection sampling, the same no-modulo-bias technique as our random number generator — because the two tools share one audited code path.
Are password generators safe to use?
Yes — when generation happens on your device and nothing is transmitted or logged, and that is a property you can verify rather than trust. Here, the page makes no network requests during generation (the site's security policy forbids tool processing from calling out, and our test suite asserts it), nothing is written to storage, and the generator keeps working offline. The ones to be wary of are tools that generate server-side: a password created on someone else's machine has, by definition, existed on someone else's machine. If you were wondering how the Norton password generator or the manager-branded ones (LastPass, 1Password, Bitwarden, NordPass) work — the same character-pool idea, wrapped in an account funnel; the good ones also generate locally, but few show you a number you can check.
How long? The 12-character question
The most-searched setting is a 12 character password generator, and 12 is a defensible floor: with all four sets, 12 characters is about 78 bits of entropy — beyond realistic offline cracking for anything but nation-state budgets. This tool defaults to 16 (≈104 bits) because the two extra taps cost you nothing when a manager does the remembering. If a site demands exactly a password generator 12 characters long, set the length slider to 12 and keep all four sets on; going shorter than 12 is where strength erodes fast — 8 characters at full pool is only ≈52 bits, which a rented GPU rig can exhaust offline in days.
There is no “strongest password generator”
Sites competing to be the strongest password generator are selling framing, not math. Strength is length × log2(pool size) — nothing else. Any generator that draws uniformly from the same pool at the same length produces exactly equally strong passwords; what makes this password generator strong is that it draws correctly (no modulo bias), tells you the bits, and shows how every option moves them. That is also why the entropy readout drops when you exclude ambiguous characters: a smaller pool is a real cost, worth paying only when a human has to transcribe the password.
How to use
- 01Pick a length with the slider or type it — 16 is the default; 12 is the common minimum worth using. Watch the bits update as you drag.
- 02Choose character sets. All four on gives the largest pool (90 characters, ≈6.5 bits each); switching one off shows you exactly what it costs.
- 03Turn on “Exclude ambiguous” only if someone will read or type the password by hand — it removes 0, O, 1, l, I and |, and the entropy readout drops honestly to match.
- 04Generate, copy, done. Need test fixtures or a batch for onboarding? Set “How many” up to 100 and copy the lot — every password is drawn independently.
Four passwords people actually generate
New account signup
Default settings, copy, paste into the signup form and your manager. Sixteen characters ≈ 104 bits — the site's hash will fall to a breach before the password does.
Length: 16 · all four sets At least one of each: on
v@8Kp;Tq2}xW4Ne!
Wi-Fi password guests will type
Exclude ambiguous characters so nobody debates 0-versus-O off the whiteboard; add length to buy back the entropy the smaller pool costs.
Length: 20 · exclude ambiguous: on
wR7#mKq2vXz9@dPe4:tY
Shared service credential
A service without SSO needs one strong secret for the team vault. Max out length — nobody will ever type it.
Length: 32 · all four sets
K2#vLp9!qW;4xN7e{RtY8@mZ3=cJ6&hBBulk test fixtures
Seeding a user table with 100 realistic, unique credentials for a load test — one click, one copy, no script.
Length: 16 · How many: 100
d$9fKe2!pQz7... (100 lines, one per password)
Entropy by length and character set
| Length | Letters (52) | + Digits (62) | All four (90) | The 90-char pool realistically resists* |
|---|---|---|---|---|
| 8 | 45.6 bits | 47.6 bits | 51.9 bits | Online guessing only — an offline rig averages it in ~2 days |
| 12 | 68.4 bits | 71.5 bits | 77.9 bits | Offline cracking — ~470,000 years on average |
| 16 | 91.2 bits | 95.3 bits | 103.9 bits | Offline cracking — billions of years; the sane default |
| 20 | 114.0 bits | 119.1 bits | 129.8 bits | Everything. Length is doing all the work |
| 24 | 136.8 bits | 142.9 bits | 155.8 bits | Everything, with decades of hardware headroom |
| 32 | 182.4 bits | 190.5 bits | 207.7 bits | Cryptographic-key territory |
*Stated assumption: an offline attacker guessing at 10¹⁰ per second, finding the password at the average point (half the space). Online attacks are rate-limited thousands of times slower. Bits = length × log2(pool).
Character sets and what exclusions cost
| Set | Characters | Excluded as ambiguous | Bits per character |
|---|---|---|---|
| Lowercase | 26 | l → 25 | log2(26) ≈ 4.70 alone |
| Uppercase | 26 | I O → 24 | pool grows, not per-set |
| Digits | 10 | 0 1 → 8 | all four on: 6.49/char |
| Symbols | 28 | | → 27 | all four minus ambiguous: 6.39/char |
Exclude-ambiguous shrinks the pool from 90 to 84 — about 1.6 bits shorter per 16-character password. Real, small, and shown in the readout instead of hidden.
Tips & best practices
- Pair this with a password manager: generate here, store there, and the “but I can't remember it” objection disappears — remembering is not your job.
- Prefer more length over more symbol classes: four extra characters buy ~26 bits; adding symbols to a letters+digits pool buys ~8.
- Leave “Exclude ambiguous” off unless a human will transcribe the password — legibility is its only benefit and it costs entropy.
- One password per site, no exceptions — the strongest 32-character string protects nothing once it's reused against a breach dump.
- The “at least one of each set” toggle satisfies picky complexity rules without biasing the draw — it discards and redraws whole passwords rather than patching characters in.
- Regenerate freely. There's no quota and no server; taste in passwords is free.
Gotchas — what silently goes wrong
P@ssw0rd! passes the rules and fails the attack
Complexity checkboxes ask for “uppercase, digit, symbol” — and human substitutions (a→@, o→0, s→$) satisfy them while remaining a dictionary word. Cracking tools apply exactly those mangling rules first. A random 12-character draw has no word to mangle; that is the entire point of generating instead of inventing.
Length beats symbol soup
Each added character multiplies the search space by the whole pool (~90×); each added character CLASS only widens the pool slightly. If a policy forces trade-offs, always take the longer password.
Server-side generation is a trust exercise
A password generated on a server existed on that server — in memory, possibly in logs, behind someone else's security. Local generation is verifiable here: unplug the network and the tool still works; the CSP forbids tool processing from phoning out.
Reuse is the real failure mode
Most account takeovers are credential stuffing: a password leaked from one site replayed against others. Password strength is irrelevant to that attack — uniqueness is the defense. Generate per site; let the manager remember.
The clipboard is a surface
Copied passwords sit in clipboard history, sync across devices on some platforms, and are readable by other apps until overwritten. Paste promptly, and prefer a manager's autofill over the clipboard for daily logins.
Technical details
- Randomness source
crypto.getRandomValues— the browser CSPRNG, OS-entropy seeded- Sampling
- Rejection sampling per character — uniform over the pool, no modulo bias (regression-tested)
- Pools
- 26 lower + 26 upper + 10 digits + 28 symbols = 90; exclude-ambiguous removes
0 O 1 l I |→ 84 - Entropy readout
- length × log2(effective pool) — recomputed from the live option state, never a static label
- “One of each set”
- Whole-password rejection: non-conforming draws are discarded and redrawn, keeping the distribution uniform (per-position fix-ups would bias it; the trimmed space costs < 0.1 bit at default settings)
- Length / bulk
- 4–128 characters · up to 100 passwords per batch
- Storage
- None. Passwords live only in this page's memory until you leave; nothing touches localStorage, cookies, or a server
- Network use
- None during generation — verified by the no-network test sweep and enforced by the CSP
Frequently asked questions
Is it safe to generate a password on a website?
It is safe exactly when the generation is local and unlogged. This page draws the password in your browser, makes no network request while doing it, writes nothing to storage, and works offline — all verifiable, none of it taken on faith. Server-side generators ask you to trust their infrastructure and their logging discipline.
How long should a password be in 2026?
Sixteen characters from the full pool (≈104 bits) is a comfortable default that outlives the hardware curve. Twelve (≈78 bits) is a reasonable floor for accounts a manager stores. Below twelve, offline cracking becomes a budget question rather than an impossibility.
What actually makes a password strong?
Two numbers: length and pool size. Bits = length × log2(pool). Uniform random draw is what makes the math apply — human-invented passwords score far below their apparent size because they are drawn from the small space of things humans invent.
Why is there no “time to crack” meter?
Because it depends entirely on an attack-rate assumption most tools never state. The entropy table above does give times — against an explicitly stated 10¹⁰-guesses-per-second offline attacker — which is the honest version of the same information.
Does this tool store or see my passwords?
No. Generation happens in this browser tab; the result exists in the page's memory until you navigate away. Nothing is transmitted, logged, or persisted — the test suite asserts no network calls and no storage writes from the generator.
What does “exclude ambiguous” change?
It removes 0, O, 1, l, I and | — six characters that look alike in many fonts — shrinking the pool from 90 to 84. The entropy readout drops by about 0.1 bits per character to match. Use it for passwords humans read aloud or type from paper; skip it otherwise.