How to use
- Set the length — 16 characters or more is a good default for accounts stored in a password manager.
- Choose which character types to include and whether to avoid look-alike characters such as I, l, 1, O and 0.
- Exclude any characters a website rejects, for example quotes or spaces.
- Copy the password, or generate several at once and copy them all.
Options explained
- Length
- Each extra character multiplies the number of possible passwords. Length matters more than symbols — 16 lowercase letters are stronger than 10 characters of every type.
- Avoid look-alike characters
- Removes I, l, 1, |, O, 0, o and quotes, so a password can be read aloud or typed from paper without mistakes. It slightly reduces entropy.
- Include every selected type
- Guarantees at least one character from each chosen set, which many sign-up forms require.
- Entropy
- Bits of randomness in the generator's output — length × log₂(pool size). 60 bits is fair, 80+ strong, 100+ very strong.
Length versus character types
Entropy for passwords made only from the given characters:
| Characters | 8 long | 12 long | 16 long | 20 long |
|---|---|---|---|---|
| Digits only (10) | 27 bits | 40 bits | 53 bits | 66 bits |
| Lowercase (26) | 38 bits | 56 bits | 75 bits | 94 bits |
| Letters + digits (62) | 48 bits | 71 bits | 95 bits | 119 bits |
| All four types (89) | 52 bits | 78 bits | 104 bits | 130 bits |
Adding four characters gains more than adding symbols to a short password.
Frequently asked questions
Are these passwords truly random?
Yes. They come from crypto.getRandomValues, the browser's cryptographically secure generator, and characters are chosen with rejection sampling so every character is equally likely.
Do you see or store the passwords?
No. They are generated by JavaScript on your device and never transmitted. Nothing is saved.
How long should my password be?
For accounts stored in a password manager, 16–20 random characters are plenty. For a master password you must remember, use a long passphrase of several random words instead.
What does the crack time mean?
It is the average time to guess the password by brute force at 10 billion guesses per second — roughly a powerful GPU rig attacking a fast hash offline. Real attacks on websites are much slower because of rate limits, but assume the worst.
Should I use the same strong password on several sites?
No. If one site leaks it, attackers try it everywhere. Use a different password for every account and let a password manager remember them.
Privacy
This tool runs entirely in your browser. Your files and text are processed on your device and are never uploaded to our servers.