Random Password Generator

How this password generator works

Every password on this page is produced by your browser's Web Crypto API (crypto.getRandomValues), the same source of randomness used for TLS keys and cryptographic tokens. It is not the predictable Math.random() that many quick tools rely on. The generator uses rejection sampling so that every character in the chosen set is equally likely, guarantees that at least one character from each enabled group appears, and then shuffles the result so those guaranteed characters do not sit in predictable positions.

Because generation happens entirely on your device, the password is never transmitted, logged or stored anywhere. You can load this page, disconnect from the network, and keep generating passwords.

Choosing a good password

Length matters more than anything else. A 16-character password drawn from letters, digits and symbols has roughly 100 bits of entropy, which is far beyond what any offline attack can brute-force. For services that limit special characters, keeping letters and digits but raising the length to 20 or more gives equivalent strength. The entropy meter under the password shows the number of bits, calculated as length × log2(size of the character set), so you can compare settings objectively instead of guessing.

Enable Exclude ambiguous characters when you will need to read the password aloud or type it from a screen: it removes 0, O, 1, l, I and | which are easy to confuse in many fonts. Generate several passwords at once when you need to set up multiple accounts, and store all of them in a password manager rather than reusing one.

Why random beats memorable

Humans choose passwords from a small, predictable space: dictionary words, names, dates, keyboard patterns and simple substitutions like a→@. Cracking tools try those first and get through most human-chosen passwords quickly. A uniformly random string has no such structure, so an attacker's only option is to try every combination. Pair a random password with a password manager and two-factor authentication and your accounts are protected against the attacks that actually happen: credential stuffing, leaked databases and phishing of reused passwords.

Background: from passwords to password managers

Computer passwords date to MIT's CTSS in 1961, and for decades the advice was to make them memorable. That changed once attackers could test billions of guesses per second against leaked hash databases: NIST's 2017 guidelines (SP 800-63B) dropped mandatory complexity rules and periodic rotation in favour of length, uniqueness and checking against known-breached lists. The practical consequence is that a human cannot hold dozens of unique 16-character strings in memory, so a generator like this one is meant to be paired with a password manager, which stores them, fills them and syncs them across devices.

Where it is used

Beyond account sign-ups, random strings from this generator work as API keys and webhook secrets, Wi-Fi passphrases you then embed in a Wi-Fi QR code, database and SMTP credentials in .env files, temporary passwords for onboarding a new employee, encryption passphrases for archives and disk images, and one-off tokens in scripts, including the secret key for an HMAC signature. For database URLs or Basic-auth headers, remember that symbols such as @, : and / must be percent-encoded, or generate without symbols and use extra length instead. When a secret has to live inside a config file or header, Base64-encoding it keeps it on one line.

Frequently asked questions