How to use the password generator
- Drag the Length slider — 16 characters is a good default for most sites.
- Tick the character types to include. More types = a bigger search space.
- Optional: exclude ambiguous characters (great when you'll type the password by hand) or ban repeats.
- Hit New to roll another password, then Copy.
Features
- Cryptographically secure — randomness comes from
crypto.getRandomValues(), not a weakMath.random(). - Guaranteed variety — every selected character type is represented at least once.
- Honest strength meter — shows estimated entropy in bits, the real measure of a random password's strength.
- 100% offline — the password is generated on your device and never leaves it.
What makes a password strong?
A password's strength is not how "complicated" it looks — it is the size of the search space, measured in bits of entropy. Roughly: entropy = length × log₂(character pool). Each bit doubles the work an attacker must do. A 16-character password with upper/lower/numbers/symbols is roughly 9516 ≈ 105 bits — far beyond what brute force can reach. Shorter, or fewer character types, drops that number fast, which is why the meter reacts to both length and your checkboxes.
The strongest password in the world is useless if it is reused or stored insecurely. Use a password manager, and let it create a unique password for every site.
Frequently asked questions
Is a 16-character password enough?
For most online accounts, 16 random characters across several character types (~100+ bits) is excellent. Some paranoid admins prefer 20+. Use the meter as your guide: if it shows 90+ bits, you are well beyond brute-force range.
Why shouldn't I just use Math.random() for passwords?
Math.random() is fast but not cryptographically secure — its output may be predictable. This generator uses crypto.getRandomValues(), the same secure source used by browsers for encryption keys.
Are these passwords generated on a server?
No. The generation runs entirely in your browser tab. When you click New, the password is created on your device and never transmitted anywhere.
What does "exclude ambiguous characters" do?
It removes characters people commonly confuse: I l 1 O 0 o. The result is slightly less dense but much easier to read aloud or type on a phone — a worthwhile trade for passwords you enter manually.
Should I let my browser remember it instead of a manager?
Browser password managers are far better than reusing passwords, but a dedicated manager keeps you portable across browsers and devices and makes it easy to generate unique, long passwords everywhere.