Password Generator

What the generator does

The Password Generator creates random passwords from 4 to 128 characters long. You move the length slider, choose which character types to include (lowercase, uppercase, numbers and symbols), decide whether to avoid look-alike characters, and pick how many passwords you want, from 1 to 20. A new password appears as soon as you change a setting, and the eye button hides the text if someone is looking over your shoulder. Each password has a copy button, and a meter underneath shows the strength in bits of entropy.

How the passwords are made

The tool uses the secure random number generator built into your browser, the same one used for encryption keys, not the predictable Math.random function. It picks each character with rejection sampling, which means every character in the pool is exactly as likely as any other, with none of the slight bias that comes from a naive remainder calculation. It first takes one character from each chosen type so the password satisfies the usual site rules, fills the rest from the whole pool, and then shuffles the result so the guaranteed characters are not always at the start. The password is created on your device and is not sent anywhere.

Length beats complexity

Entropy, measured in bits, is the length multiplied by the base-2 logarithm of the size of the character pool. The full pool here is 88 characters: 26 lowercase letters, 26 uppercase letters, 10 digits and 26 symbols. These figures come straight from the meter, and the guessing time assumes an attacker who has stolen a database and can try 10 billion passwords a second.

• 8 lowercase letters: 37.6 bits, Weak, cracked in about 10 seconds.
• 8 characters of all four types: 51.7 bits, Fair, about 2 days.
• 12 letters and digits: 71.5 bits, Good, about 5 thousand years.
• 12 characters of all four types: 77.5 bits, Good, about 342 thousand years.
• 16 characters of all four types: 103.4 bits, Strong, billions of years.
• 20 letters and digits: 119.1 bits, Very strong.

What the strength labels mean

The label is based on bits: under 40 is Weak, 40 to 59 is Fair, 60 to 79 is Good, 80 to 109 is Strong, and 110 or more is Very strong. The meter slightly overestimates, because guaranteeing one character of each type removes a few possibilities. Notice that a 16-character password of letters and digits (95.3 bits) is far stronger than an 8-character one with symbols (51.7 bits). When a site lets you, choose length first. For anything important, use 16 characters or more.

Look-alike characters and site rules

Ticking "Avoid look-alike characters" removes 0, O, o, 1, l, I and the pipe character, which reduces the full pool to 82 characters. A 16-character password then has 101.7 bits instead of 103.4, a tiny cost for something you can read aloud or type from paper without mistakes. Some websites reject certain symbols. The generator uses a fixed set, !@#$%^&*()-_=+[]{};:,.<>?/, so if a site refuses it, untick Symbols and make the password longer to make up the strength.

Using passwords safely

A random password is only useful if it is unique and stored. Use a different one for every account, keep them in a password manager, and turn on two-step verification where it is offered. The tool does not save anything, so copy the password before you leave the page. For the one password you must remember, such as the manager's master password, a passphrase of several random words is easier to recall: four words drawn from a 7,776-word list give about 51.7 bits and six give about 77.5. To check a password you already have, use the Password Strength Checker, and for background, read length versus complexity and the differences between hashing, encoding and encryption. The UUID Generator creates random identifiers, which are not a substitute for passwords.