Strong Password Generator

Why use a password generator?

People are bad at making up random passwords. We use names, birthdays, keyboard patterns like "qwerty" and the same password on many sites. Attackers know these habits and try them first. When one website is hacked, reused passwords let criminals into your email, bank and social accounts too.

This password generator creates truly random passwords using your browser's built-in cryptographically secure random number generator (crypto.getRandomValues), the same kind of randomness used for encryption. Passwords are created on your device and are never sent to our server or stored.

Options

• Length from 4 to 128 characters
• Uppercase letters, lowercase letters, numbers and symbols
• Exclude look-alike characters like 0 and O or 1, l and I, handy for passwords you need to type by hand
• Generate up to 50 passwords at once
• A strength meter that shows the estimated entropy in bits

Every selected character type is guaranteed to appear at least once, and the order is shuffled so there is no pattern.

How to use it

1. Move the slider to choose a length. 16 or more is a strong default.
2. Tick the character types you want.
3. Click Generate password, then Copy.
4. Save it in a password manager straight away.

How strong is strong enough?

Strength is measured in bits of entropy: how many guesses an attacker would need. Each extra character multiplies the work. As a rough guide:

A 16-character password using all four character types is about 104 bits, far beyond what can be guessed. Length matters more than complexity, which is why the US standards body NIST recommends long passwords in its digital identity guidelines.

Good password habits

• Use a different password for every account.
• Store them in a password manager, so you only need to remember one master password.
• Turn on two-factor authentication wherever you can.
• Never share passwords by email or chat.

Need to share WiFi details without typing a long password? Our QR Code Generator has a WiFi mode. See all text and developer tools.

Related security tools

A strong password is only one part of staying safe online. If you run a website, check that it uses a valid certificate with our SSL Checker and review its security headers with the HTTP Header Checker. Developers who need to encode tokens can use the Base64 Encoder, which also runs locally in your browser.

How strong is a random password?

Password strength is often measured in bits of entropy: the higher the number, the more guesses an attacker needs. Every extra character multiplies the number of possible passwords, which is why length matters more than anything else.

A 16-character random password from the full character set is far beyond what any attacker can brute-force with today's hardware. The generator shows an estimate of the strength as you change the options.

How this generator creates passwords

Passwords are created in your browser with the Web Crypto API (crypto.getRandomValues), the same secure random number source browsers use for encryption. The tool also uses rejection sampling, so every character in the set has exactly the same chance of being picked; there is no hidden bias towards certain letters. Nothing is sent to a server or saved, and each password disappears when you close the page.

Modern password advice

The US standards body NIST publishes guidance on passwords in its Digital Identity Guidelines (SP 800-63B). In simple terms, current advice is:

• Prefer long passwords; length beats complicated rules.
• Use a different password for every account, so one leak does not unlock everything.
• Do not change passwords on a fixed schedule without a reason; change them when there is a sign of compromise.
• Check new passwords against lists of leaked passwords.
• Turn on two-factor authentication wherever it is offered.

Use a password manager

Nobody can remember dozens of random passwords. A password manager stores them in an encrypted vault and fills them in for you. Most browsers have one built in, and dedicated apps work across phones and computers. You then only need to remember one strong master password. Generate it here, or use a long passphrase of several unrelated words.

When to exclude look-alike characters

Turn on "Exclude look-alikes" to remove 0, O, l, 1 and I when a password will be read aloud, typed from paper or entered on a TV remote, such as a WiFi password for guests. You can even share a WiFi password as a scannable code with the QR Code Generator. Some systems also reject certain symbols; if a site refuses your password, untick Symbols and increase the length instead.

Protecting accounts beyond the password

A strong password is the first layer, not the only one. Turn on two-factor authentication using an authenticator app or a security key where possible, because SMS codes can be intercepted through SIM swaps. Watch out for phishing: no bank, delivery company or social network should ask for your password by message or phone call. Keep your phone and browser updated, since updates fix security holes. And check whether your email appears in known data breaches using a reputable breach-alert service, then change any reused passwords immediately.

Last updated: October 25, 2026