Password Generator
Generate strong passwords locally: pick length and character sets, exclude look-alikes; live entropy-based strength meter.
crypto.getRandomValues — generated entirely on your device; no server (including this site's, if it even has one) can ever know.>_ USAGE GUIDE
Drag the length slider, tick the character sets you want (uppercase, lowercase, digits, symbols), and click — a strong password appears instantly, and clicking again produces another. You can exclude look-alike characters (0/O, 1/l/I), which makes passwords far easier to type manually into a TV box or game console without transcription errors.
- Set the length: 16+ is the recommended baseline for anything that matters
- Choose the character sets: more variety means more entropy per character
- Exclude look-alikes: turn this on when a human will type the password by hand
- Read the entropy meter: a live bits value is a far better strength indicator than a red/yellow/green traffic light
Each password is evaluated with a real-time entropy calculation — entropy is the scientific measure of strength, not the presence of special characters. Pair the tool with a password manager: generate a unique random password for every account, store it in the manager, and memorize only the manager's master password.
Generation uses the browser's cryptographically secure random source (CSPRNG), runs entirely locally, and never writes the password to the network or to storage.
>_ FAQ
Q1 · How long does a password need to be?
An 8-character lowercase-only password falls to a modern GPU in hours. The recommended baseline is 16+ characters mixing upper- and lowercase letters, digits, and symbols — enough entropy to make brute force infeasible for the foreseeable future. Passwords stored in a manager can safely go 20 characters and beyond.
Q2 · How is password strength measured — why can a 10-character password be weaker than an 8-character one?
Strength is determined by entropy: the possibilities per character times the length. A larger character set and a longer length both raise it. That is why P@ssw0rd is weak despite looking complex — it is patterned and sits in dictionaries — while a purely random string like k7#mQx2vR9 resists guessing far better. This tool shows the entropy in bits directly; higher is stronger.
Q3 · Is it safe to generate passwords here? Are they recorded?
No record is kept. Generation uses the browser's local cryptographic random interface, the process makes zero network requests, and the result is never written to storage — close the tab and it is gone, recoverable only from your password manager. This is precisely why local generation beats online tools that generate server-side and transmit the password to you.
Q4 · Why exclude look-alike characters?
0 and O, or 1, l, and I, are nearly indistinguishable in many fonts — a real problem whenever a human types the password manually into a smart TV, a console, or someone else's machine. With exclusion enabled the generator skips those characters; the slightly smaller alphabet costs about 8% of the combinations, which adding one or two characters of length easily recovers.
Q5 · Why not reuse one password everywhere?
One breach becomes every breach: credential-stuffing attacks take leaked email-plus-password pairs and replay them across other services. The correct pattern is a unique random password per account, held by a password manager, with two-factor authentication enabled on the accounts that matter most — email and payment first.