How this generator works
Passwords are built with your browser's cryptographically secure random number generator (crypto.getRandomValues), not the weaker Math.random. The tool picks characters without bias, makes sure at least one character from each selected type appears, and then shuffles the result. The password exists only on this page: it is not transmitted, logged or stored.
What makes a password strong
Strength comes mostly from length and true randomness. Each extra character multiplies the number of possible passwords, so a longer password is far harder to guess than a shorter one with more symbols. The entropy shown is the length times the base-2 logarithm of the number of possible characters, an estimate of how many guesses an attacker would need.
| Entropy | Rating |
|---|---|
| Under 40 bits | Weak |
| 40 to 59 bits | Fair |
| 60 to 79 bits | Strong |
| 80 bits or more | Very strong |
Good password habits
- Use a different password for every account. When one site is breached, reused passwords let attackers try the same login elsewhere.
- Use a password manager so you do not have to remember long random strings.
- Turn on two-factor authentication or passkeys for email, banking and any account you cannot afford to lose.
- Aim for at least 14 to 16 characters for important accounts.
- Avoid personal details such as names, birthdays or pet names, and avoid simple substitutions like "P@ssw0rd".
A note on look-alike characters
If you will ever type the password by hand, for example on a TV or a shared device, tick the option that removes characters such as O, 0, I, l and 1. It slightly reduces the pool of characters, so add a couple of extra characters of length to compensate.