Password Generator

Generate secure passwords with custom length, character options, and strength indicator.

GeneratePasswordSecurityStrength
Min: 4, Max: 128

Character Types

Click Generate to create passwords

A password is strong when the only way to find it is to try every possibility, which depends on two things: its length and a truly random choice of characters. This tool builds passwords from the character sets you choose, picking every character with the browser's cryptographically secure random number generator (crypto.getRandomValues) rather than Math.random.

With all four sets enabled the pool is 88 characters, so each character adds about 6.5 bits of entropy and a 16-character password carries roughly 103 bits. Length does more than extra character types: going from 16 to 20 characters adds about 26 bits.

Passwords are created in the page only when you click a Generate button. They are not sent anywhere and are gone when you clear or reload. To hand a new credential to a teammate without pasting it into chat, share it through an encrypted private note. If you need a unique identifier rather than a secret, a UUID is the better fit.

  1. Set the length with the slider or the number box (4 to 128 characters).
  2. Tick the character types to include. Turn on Exclude Ambiguous or Avoid Similar if the password will be read aloud or typed by hand.
  3. Click Generate for one password, or Generate 5, 10 or 20 for a batch.
  4. Hover over a password to reveal it or copy it. With more than one result, Copy All copies them one per line.
  5. If a site requires a particular character type, check the result contains it, and generate again if not.

  • Length from 4 to 128 characters
  • Uppercase, lowercase, digit and symbol sets, each switchable
  • Exclude Ambiguous and Avoid Similar filters for hand-typed passwords
  • Randomness from crypto.getRandomValues
  • Batch generation of 5, 10 or 20 passwords with Copy All
  • Passwords masked by default, with a show/hide toggle
  • Weak / Medium / Strong label for each result

16 characters, all sets

k7#Qm2!vR9@xLp4Z

An example of the default settings. 88-character pool, about 103 bits of entropy, rated Strong.

20 characters, letters and digits, Exclude Ambiguous on

hT4bWq9ZcK3mYe7PdR2s

For systems that reject symbols. The pool drops to 55 characters, but the extra length gives about 115 bits. Rated Strong.

8 digits only

40718263

About 27 bits, rated Weak. Only suitable where attempts are rate-limited, such as a device PIN.

Select at least one character type

Uppercase, Lowercase, Numbers and Symbols are all unticked, so there are no characters to choose from. The Generate buttons are disabled.

Tick at least one of the four character types.

A website rejects the generated password

The site has its own rules: a maximum length, a restricted list of allowed symbols, or a required character type the random result happens to lack.

Lower the length to the site's maximum, untick Symbols if it disallows some of them, or generate again until the required types appear.

The password breaks a shell command or config file

Symbols such as $ & | ; < > ( ) have special meaning in shells, and # starts a comment in .env and YAML files.

Wrap the value in single quotes in a POSIX shell and in quotes in config files, or generate a letters-and-digits password with a longer length.

How is the Weak / Medium / Strong label calculated?

It is a simple checklist of six points: contains uppercase, lowercase, digits, symbols, is at least 12 characters, is at least 16 characters. Passwords under 8 characters lose 2 points. 0–2 points is Weak, 3–4 Medium and 5–6 Strong. It is a rule of thumb, not an entropy calculation.

What exactly do Exclude Ambiguous and Avoid Similar remove?

Exclude Ambiguous removes i, l, 1, L, o, 0 and O. Avoid Similar removes r, n, R, N, 0, O, I, l, 1 and L, and also removes the comma from the symbol set. Both shrink the pool slightly, so add a character or two of length to compensate.

Is every selected character type guaranteed to appear?

No. Each character is drawn independently from the combined pool, which keeps the output uniformly random. A short password can therefore miss a type, such as having no digit. Generate again if a site insists on one.

Which symbols are used?

The symbol set is !@#$%^&*()_+-=[]{}|;:,.<>? . Quotes, backslash, backtick, tilde, slash and space are not included, which avoids most escaping problems in shells, .env files and JSON.

How long should a generated password be?

For passwords kept in a password manager, 16 to 20 random characters from all four sets already exceeds 100 bits, far beyond practical brute force. If a system allows longer passwords and you never type it by hand, use more.