Password Generator

This free password generator creates random passwords right in your browser. It uses the browser’s secure random number source, shows how strong each password is, and never sends the result anywhere.

How to use the password generator

1. Set the length, anywhere from 8 to 64 characters.
2. Choose the character types to include: upper case, lower case, numbers and symbols.
3. Turn on exclude look-alike characters if the password will be read or typed by hand. This leaves out O, 0, l, 1 and I.
4. Generate 1 or 5 passwords, check the strength estimate in bits, and press Copy.

How the strength in bits is worked out

For a password picked truly at random, strength is measured as entropy in bits. Each character adds log2(pool size) bits, where the pool is the number of characters it could have been. The total is the length multiplied by that figure. Every extra bit doubles the number of guesses an attacker would need.

Symbols add a few more characters to the pool, and excluding look-alikes removes a few, so the exact figure in the tool changes slightly with your choices. Notice that length matters more than variety: switching a 16-character password from lower case to mixed letters and numbers adds about 20 bits, while adding eight more lower-case characters adds about 38.

What NIST recommends

The US National Institute of Standards and Technology publishes widely used password guidance in NIST SP 800-63B. The current revision says, among other things:

• Passwords used on their own should be at least 15 characters; passwords used together with another factor, such as an OTP, may be as short as 8.
• Services should allow passwords of at least 64 characters.
• Services should not force mixtures of character types, and should not force regular password changes unless there is a sign of a breach.
• Services should check new passwords against lists of common and leaked passwords, and should allow password managers and pasting.

In practice, a long random password from this password generator, saved in a password manager, meets these ideas well. Use a different password for every account, so one leak does not open the others, and turn on two-step verification wherever it is offered.

Why the browser’s random generator matters

JavaScript’s Math.random() is fine for games, but it is not designed for security. This tool uses crypto.getRandomValues(), which gives cryptographically strong random values. If you are learning JavaScript, our lessons on functions and arrays cover the basics you need to read code like this:

const chars = 'abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789';
const bytes = new Uint32Array(16);
crypto.getRandomValues(bytes);
// note: % adds a tiny bias; real generators avoid it
const password = Array.from(bytes, b => chars[b % chars.length]).join('');

Learn more

• Base64 Encoder & Decoder
• URL Encoder & Decoder
• JavaScript Functions
• PHP Forms: GET and POST
• HTML Form Best Practices: Labels, Validation and Accessible Errors

Frequently asked questions