Password Generator

How to use the password generator

1. Pick a type. A random password gives maximum strength per character. A passphrase is longer but far easier to type and remember.
2. Adjust the settings. A new password is generated each time you change one, so what you see always matches the controls.
3. Check the strength. The meter shows entropy in bits and an estimated time to crack, based on a deliberately pessimistic attack rate.
4. Copy it and store it somewhere safe — ideally a password manager.

Nothing is uploaded. Everything is generated on your device.

When you would need this

Creating an account. The password you invent will be weaker and more predictable than a generated one, however clever the substitutions.

Replacing a reused password. Reuse is the single biggest practical risk in personal security — one breach exposes every account sharing that password.

After a breach notification. If a service you use has been compromised, that password should be replaced everywhere it appeared.

Generating a WiFi password. A passphrase works well here: it is long, strong, and readable aloud to a guest.

Creating an API key or token. Long random strings are exactly what these need, and the symbol set can be turned off where a system only accepts alphanumerics.

Why length beats complexity

The familiar advice — mix uppercase, numbers and symbols — is not wrong, but it is far less important than it sounds, and it has done real damage by making passwords hard for people and barely harder for machines.

The arithmetic is straightforward. Password strength is the size of the character pool raised to the power of the length. Adding character types grows the pool: lowercase alone is 26, adding uppercase makes 52, adding digits 62, adding symbols about 89. But adding length grows the exponent, and an exponent beats a base every time.

An eight-character password using all four types has about 52 bits of entropy. A twelve-character password using only lowercase letters has about 56 — stronger, despite looking far simpler, and vastly easier to type. Extend the lowercase one to sixteen characters and it reaches 75 bits, comfortably beyond what the complex short one achieves.

There is a second problem with complexity rules: they push people toward predictable patterns. Told to add a capital and a number, most people capitalise the first letter and append a 1, or substitute 3 for e and @ for a. Password-cracking software has applied those transformations by default for twenty years, so they add almost nothing while making the password unpleasant to use.

This is why modern guidance — including NIST's — recommends long passwords or passphrases and discourages mandatory complexity rules. The generator here defaults to twenty characters for exactly that reason.

Tips for using passwords well

Use a password manager. A generated password is only useful if you do not have to remember it, and a manager removes the reason people reuse passwords in the first place. It also generates locally and stores encrypted, which is a better arrangement than any web page for your most critical credentials.

Never reuse a password. A strong password used in three places fails in all three the moment any one service is breached. Uniqueness matters more than strength: a merely decent unique password is safer than an excellent shared one.

Choose a passphrase for anything you have to type. WiFi keys, device unlock codes, and the master password for your manager all get typed by hand regularly. Six or more random words is strong and far less painful than twenty random characters.

Turn on two-factor authentication. It protects the account even if the password is compromised, and it matters more than the marginal difference between a good password and a great one.

Do not rotate passwords on a schedule. Forced periodic changes push people toward small predictable increments — Summer2024, then Summer2025. Change a password when there is a reason to: a breach, a shared device, a suspicion.

Limits and requirements

The strength estimate is a model, not a guarantee. It assumes an offline attack against a stolen database at 100 billion guesses per second, which is a reasonable figure for a fast hash on commodity hardware. A service using a properly slow algorithm makes attacks far harder; a service storing passwords badly makes them easier. The estimate also assumes the attacker knows your generator settings, which is the correct pessimistic assumption.

Entropy is an upper bound. Requiring one character from every selected type slightly constrains the output and reduces true entropy by a fraction of a bit. It is small enough to ignore at realistic lengths, but the displayed figure is the ideal rather than an exact measure.

Some sites reject symbols or cap length. Turn off the symbol set or reduce the length to fit. A site that caps passwords at 12 characters is telling you something about how it stores them.

No history is kept. Generated passwords exist only in the tab. Copy before navigating away — there is no way to recover one afterwards.

Requires a secure context. Both the cryptographic random number generator and the clipboard require HTTPS, which this site always uses.

Privacy: how this tool handles your passwords

Passwords are generated in your browser, on your device, using the operating system's cryptographic randomness by way of the Web Crypto API. Nothing is transmitted, logged, or stored. There is no server involvement at any point.

This is the category where it matters most. A password generated on someone else's server is a password that someone else has seen, and a password that appeared in a request body is a password that may sit in a web server log, an error-tracking service, or a backup for months. The site need not be malicious for this to be true — ordinary, well-intentioned infrastructure logs requests.

You do not have to take this on trust. Open your browser's developer tools, switch to the Network tab, and generate a few passwords: nothing is sent. For a stronger demonstration, load this page, disconnect from the internet entirely, and keep generating. It works, because there is nowhere else for the work to happen.

That said, apply the general principle here too: for the credentials protecting your email, your bank and your password manager itself, a dedicated password manager that generates locally and stores encrypted is the better tool. This generator is for everything else.