Skip to content
GivenTool

Random password generator

Random passwords from crypto.getRandomValues, 8 to 64 characters, with the entropy in bits and a strength label.

Settings
16 chars

Useful for passwords that will be read aloud or typed from paper.

Runs in your browser. Nothing you type is sent anywhere.

Every character is drawn with the browser's cryptographic random number generator (crypto.getRandomValues), the same source password managers use. The tool uses rejection sampling rather than a modulo, so each character in the pool is exactly equally likely. Nothing is sent to a server and nothing is stored; refresh the page and the password is gone unless you copied it.

The entropy line tells you how hard the password is to guess: length × log2(pool size) bits. Sixteen characters from all four classes (94 symbols) give about 105 bits; twelve lowercase letters give 56. As a guide, 60 bits or more resists offline cracking of a well-hashed password for years, and 128 bits is beyond any practical attack. The strength bands shown are this tool's heuristic; what matters is the number of bits.

Generating a password is the easy part. Use a different one for every account and keep them in a password manager; the manager's own generator is equally good. If a site limits length or bans symbols, lengthen the password instead of weakening the character set: two extra lowercase letters add roughly the same entropy as switching on symbols.

How to use it

  1. Set the length (16 or more is a good default) and pick the character classes.
  2. Turn on "Exclude look-alikes" if the password will be read out or typed from paper.
  3. Click Generate, or change any setting and the password regenerates.
  4. Copy it into your password manager. Ask for several at once with the "How many" field.

Frequently asked questions

Is the password generated on a server?

No. It is produced by your browser's crypto.getRandomValues, which draws from the operating system's random source. You can disconnect from the network before generating.

What does the entropy figure mean?

The number of bits an attacker must guess. Each additional bit doubles the number of possibilities. A 16-character password from 94 symbols has 94^16 possibilities, about 2^105, hence 105 bits.

Are passphrases (several words) better?

They are easier to remember and, at four or five random dictionary words, comparable in entropy to a 12-character random string. For anything you paste from a manager, random characters give more entropy per character.

Why exclude ambiguous characters?

In many fonts I, l and 1, or O, 0 and o, look identical. If someone will read the password from paper or over the phone, excluding them avoids failed logins. It costs a little entropy; add two characters of length to compensate.

Does every generated password contain at least one of each class?

Not guaranteed. Characters are drawn independently, which is what makes the entropy figure exact. With 12 or more characters the chance of missing a whole class is tiny; if a site insists, generate again.

Related tools