Password Generator
Cryptographically secure passwords with entropy strength meter
About this tool
This free password generator creates cryptographically secure random passwords directly in your browser using the Web Crypto API. Every password is generated locally — nothing is transmitted to any server, logged, or stored anywhere. You can choose length (8–128 characters), include or exclude uppercase letters, lowercase letters, numbers, and symbols, and filter out ambiguous characters (0/O, 1/l/I) that cause confusion when reading passwords aloud.
The entropy meter shows the information-theoretic strength of your password in bits. Entropy is calculated as log₂(character pool size) × length. A password with 80+ bits of entropy is considered computationally infeasible to crack by brute force with current technology — even using a GPU cluster running billions of attempts per second, it would take longer than the age of the universe. Aim for at least 64 bits for basic accounts and 80+ bits for financial or sensitive accounts.
Best practices for password security: use a unique password for every account (reuse is the primary cause of credential stuffing attacks). Use a password manager (Bitwarden, 1Password, or the built-in browser keychain) to store them — you should only need to remember one master password. Enable two-factor authentication (2FA) on every account that supports it, as it protects you even if a password is compromised in a data breach.
A common misconception is that complex passwords with special characters are automatically stronger than long simple passwords. A 20-character lowercase passphrase like "correct-horse-battery-staple" has more entropy than an 8-character "P@ssw0rd!" style password. Length contributes more to strength than character set diversity, which is why this generator defaults to longer lengths.
Frequently asked questions
Are the passwords generated here safe to use?
Yes. Passwords are generated in your own browser using the Web Crypto API, which is a cryptographically secure random number source. Nothing is sent over the network, stored, or logged, so no server ever sees the password you generate.
How long should a strong password be?
At least 16 characters for everyday accounts and 20 or more for email, banking, and password manager master passwords. Length adds more strength than special characters do, so a longer password drawn from a simpler character set usually beats a short complex one.
What does password entropy in bits actually mean?
Entropy measures how many guesses an attacker would need on average, expressed as a power of two. Each extra bit doubles the work. Below 50 bits is weak, 64 bits is adequate for low-value accounts, and 80 bits or more is considered infeasible to brute-force with current hardware.
Should I use a passphrase instead of a random password?
A long random passphrase of four or more unrelated words is excellent for passwords you must memorize, such as a password manager master password. For everything else, a fully random generated string is stronger per character and there is no need to memorize it.
How often should I change my passwords?
Current NIST guidance is not to rotate passwords on a schedule, because forced changes push people toward weak, predictable variations. Change a password immediately if a service reports a breach, if you reused it elsewhere, or if you suspect it was exposed.
Why would I exclude ambiguous characters?
Characters like 0 and O, or 1, l and I, look nearly identical in many fonts. Excluding them helps when a password has to be read aloud, copied by hand, or typed from a printed sheet. It slightly reduces entropy, so prefer adding a few characters of length to compensate.