What makes a password strong
A strong password is one that nobody can guess and no program can find by trying many combinations. Two things decide this: how long it is, and how unpredictable it is. A short password built from a pet name and a birth year is easy to guess, because people choose predictable patterns.
This generator removes the human habit from the process. It asks your browser for random numbers and uses them to pick every character, so there is no pattern to find. Our text case converter and word counter work in the same private way.
How this generator creates a password
Secure randomness. The tool uses the random number generator built into your browser. It never uses the ordinary, predictable random function meant for games and animations.
No bias. A common mistake is to take a random number and use the remainder after dividing by the size of the character list. That slightly favours the first characters. This tool avoids it by throwing away any random value that would cause the bias and drawing again, a method called rejection sampling. Every character in your selected sets has the same chance at every position.
Every set is included. If you tick uppercase, lowercase, numbers and symbols, the password always contains at least one of each. The tool first picks one character from every selected set, fills the remaining places from all selected sets together, and then shuffles the whole result so the guaranteed characters do not sit at the start.
Your options. You can choose a length from 4 to 128 characters, switch each character set on or off, and exclude look-alike characters. At least one set must stay selected, so the tool will not let you untick the last one.
Password or passphrase?
A password is a string such as k7Rm2xQvB9nTf4Ws. It is compact and strong, but hard to remember or type. It is the right choice when a password manager stores and fills it for you.
A passphrase is several random words, such as acorn-river-pilot-sunny-maple. It is longer to type but much easier to read, say aloud and remember. It suits situations where you must type the secret yourself, such as unlocking a computer or a password manager.
In passphrase mode you choose how many words to use, which separator goes between them, whether each word starts with a capital letter, and whether a number from 0 to 99 is added at the end. The words are picked at random from a built-in list. A phrase you make up yourself is usually easier to guess than people expect, which is why random selection matters.
Reading the strength indicator
Under the result you see a label and a bar. The label (Weak, Fair, Strong or Very strong) and the number of filled bar segments say the same thing, so you do not need to rely on colour.
The estimate is based on entropy, a measure of how many equally likely results the generator could have produced. For a password, the tool multiplies the length by the number of bits each character adds, which depends on how many different characters are in the pool. For a passphrase, it multiplies the number of words by the bits each word adds, which depends on the size of the word list. More bits means more guesses are needed.
Treat the label as a guide, not a promise. It only describes how hard a randomly generated value is to guess. It cannot protect you if a website stores passwords badly, if you type the password into a fake page, or if your device has malware.
Exclude look-alike characters
Some characters are easy to confuse: the capital letter O and the digit zero, and the lowercase l, the digit one and the capital I. If you will read a password from a screen and type it on another device, or share it by phone, tick Exclude look-alike characters. The pool becomes a little smaller, so each character adds slightly fewer bits. You can make up for it by adding a few characters of length.
Habits that matter more than the generator
- Use a different password for every account. If one site is breached, a reused password lets attackers try it elsewhere.
- Use a password manager. Then you only need to remember one strong passphrase, and every other password can be long and random.
- Turn on two-step sign-in where a site offers it, as a second barrier if a password leaks.
- Check the length limit. Some sites only accept a certain number of characters or reject some symbols. If a symbol is refused, untick symbols and add length instead.
Privacy: what happens to the password
The password is created on your own device. It is shown on this page and nowhere else. It is not saved in cookies or browser storage, not written to a log, and not sent to a server. When you close or refresh the page, a password you did not copy is gone and cannot be recovered. If you copy it, it sits in your clipboard until you copy something else, so paste it into your password manager straight away.
Like every page on this site, this one may show ads from third-party vendors once ads are switched on, and those vendors can use cookies. Read the privacy policy for details.