Generate a random password in your browser

How the generator works

The password is created in your browser by the cryptographic generator crypto.getRandomValues — the same source of randomness that browsers use for encryption. Neither the password nor its length is sent to a server: the page makes no network requests at all after loading. Copy the password and store it in a manager, not in a chat.

Character sets can be combined: lowercase and uppercase letters, digits, symbols. The larger the set, the more possible combinations at the same length. The “exclude similar” option removes l, 1, I, O and 0 — characters that are easy to confuse when typing by hand.

How many characters you need

The guideline is simple: for important accounts, 16 characters or more with digits and symbols; for ordinary services with two-factor authentication, 12–14 is enough. Length matters more than “complexity”: a password of 20 random lowercase letters is stronger than a short one that uses every set.

What entropy is

Entropy is the logarithm of the number of possible passwords, in bits. A password 16 characters long from a set of 68 characters gives about 97 bits: brute-forcing that space with modern hardware is not worthwhile. 40 bits is already weak, 60 is acceptable for a household account, 80 and above is a serious level. Each additional character adds log₂(set size) bits.

The generator does not check the password against leaks and does not save it. If the account supports two-factor authentication, enable it: that matters more than inventing a 30-character password.