Strong Password Generator

Nothing is generated until you press the button, so you can set everything up first.

1. Drag the Length slider, which runs from 8 to 64 and starts at 16.
2. Choose the character sets: Uppercase A-Z, Lowercase a-z, Numbers 0-9 and Symbols !@#$. All four are on by default, and at least one must stay on.
3. Tick Exclude look-alikes (0 O l 1 I) if you will read the password aloud or copy it from paper.
4. Set How many, from 1 to 20. Several passwords are listed one per line.
5. Click Generate password, then use Copy or Download.

A meter and a note under the result show the estimated entropy and a one-word rating.

Randomness comes from crypto.getRandomValues, the secure generator built into modern browsers, rather than the predictable Math.random. Values are drawn with rejection sampling so no character is favoured. The tool takes one character from every set you ticked, fills the remaining places from all ticked sets combined, then shuffles the order with a Fisher-Yates shuffle.

The pools hold 26 uppercase letters, 26 lowercase letters, 10 digits and 27 symbols (! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . < > ? / ~), 89 characters in all. The look-alike option removes O and I, l, and 0 and 1, leaving 84. The entropy figure is the length times log2 of the pool size:

The labels are: under 40 weak, 40 to 59 fair, 60 to 89 strong, 90 and above very strong. Because one character per set is placed deliberately, the true figure is marginally below the formula, which does not change the rating in practice.

To put the numbers in context, each extra character in the all-sets setting multiplies the number of possible passwords by 89, so going from 16 to 17 characters makes guessing 89 times harder. The figure only describes a password that came straight from the generator. If you alter it by hand, or reuse it, the number no longer applies, and a strong password typed into a fake login page is still lost. Generating several at once is fine: each one is an independent draw, so you may pick whichever you like.

The ticked sets matter more than they seem. With only Numbers ticked, a 16 character result is about 53 bits, far weaker than 16 characters from all four sets at 104 bits, even though both have the same length. If the note under the result says weak or fair for an account that matters, add length or tick more sets.

A long random password is only as safe as how you store and reuse it.

• Use a different password for every account, so one leaked database does not open the others.
• Prefer length over complexity. A site that rejects symbols can still accept a long password: untick Symbols and raise the length instead. You cannot edit the symbol list itself.
• Keep passwords in a password manager rather than a note or email, and add two-factor authentication where it is offered.
• Do not edit a generated password to make it memorable. Random strings are meant to be stored, not recalled.
• Nothing is saved: closing the page discards the result, so copy it into your manager first.
• Some sites cap the length or quietly cut a long password. After changing one, sign out and sign in once to confirm the whole password was accepted.
• For something you must type on a television or games console, lowercase letters plus numbers is easier. Twenty characters from that pool of 36 is still about 103 bits.

Passwords are made on your device and are not sent anywhere, but this is general information, not a security audit of your accounts. For other identifiers, see the UUID generator and the random username generator. To see how a value is fingerprinted, the hash generator is a good companion, and the Base64 encoder converts binary-safe text.