Password Generator

Pick a length and the characters you want. The password is drawn in your browser, and the strength is the entropy of that draw.

Alphabet size: 62

Hit Generate and a fresh password shows up here.

Learn more about password entropy

What is this tool?

A generated password is a sequence drawn at random from an alphabet you choose. The size of that alphabet and the length of the draw decide how many other passwords an attacker would have to try. That quantity is the entropy, written H = L × log₂(N), where L is the length and N is the number of allowed characters.

This tool draws the password in your browser with the Web Crypto random source, and it prints that entropy. The figure describes this draw. It is not a guess about a password a person invented, and it is not a promise about how fast a particular machine can hash.

Typical use cases

Creating a password for an account, then storing it in a password manager.
Comparing two generator settings by their entropy before you commit to one.
Skipping characters that look alike when the password will be read aloud or typed from a screen.

How to use it

Set the length, from 4 to 128.
Turn on the character sets you want: lowercase, uppercase, digits, symbols.
Turn on Skip lookalikes if 0 , O , o , 1 , l , I and | should be left out.
Press Generate, read the entropy, then copy the password.

Generation runs entirely in your browser. The password is not uploaded and it is not stored by this page.

A share link contains the password in the URL fragment. Anyone who opens that link can read it.

Before / after examples

These examples show the entropy of a setting. They are not passwords to reuse. A real click draws different characters every time.

Eight lowercase letters

Before

length 8, lowercase (N = 26)

After

8 × log₂(26) = 37.6 bits

Twenty characters from the full alphabet

Before

length 20, lowercase, uppercase, digits, symbols (N = 94)

After

20 × log₂(94) = 131.1 bits

Under 28 bits the tag says Very weak, under 36 Weak, under 60 Fair, under 80 Strong, and from 80 upward Very strong. The bar is full at 80 bits. Sixteen characters from the 62 letters and digits land near 95.3 bits, so the bar is full.

Common mistakes

A short draw, even from digits only

Short

length 4, digits → 4 × log₂(10) = 13.3 bits

Longer

length 16, digits → 16 × log₂(10) = 53.2 bits

Adding a symbol set grows the alphabet, and entropy only moves with the logarithm of that size. Going from 62 characters to 94 adds about 0.6 bit per character. Adding four characters of length adds far more. Length is the lever that moves the number.

A password that looks complicated, such as a word with a symbol swapped in, can have far less entropy than a shorter random draw. This meter does not score passwords you invent. It only scores a uniform draw from the alphabet on screen.

Every character is drawn from the whole alphabet. A short password can miss a set you turned on. That is expected: the entropy formula counts every character that could have appeared, including the ones this particular draw did not use.

Good to know

Each character is chosen with crypto.getRandomValues . Values that would bias a modulo are thrown away and drawn again, so every character in the alphabet is equally likely.
Lowercase is a–z, uppercase is A–Z, digits are 0–9. Symbols are the 32 ASCII characters listed below. Skip lookalikes removes 0 , O , o , 1 , l , I and | from whichever sets are on.
Changing the length or the sets does not replace the password until you press Generate again. The entropy stays attached to the password on screen.
The share link stores the settings and the password that was generated. Opening it does not draw a new one.
Length runs from 4 to 128. This page does not store a history and it does not check the password against a breach list.

Symbol characters

!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

Did you know?

NIST Special Publication 800-63B, published in June 2017, tells verifiers not to impose composition rules on memorized secrets. The guidance pushes length instead, because people answer “must include a symbol” with predictable tricks. A random generator is a different case: the alphabet size really is N in H = L × log₂(N), since the characters are not chosen by a person.

One bit is a yes-or-no question. A 4-digit PIN has about 13.3 bits, so about ten thousand possibilities. Eighty bits is 2⁸⁰ possibilities, which is why the bar on this page fills there. The number is the size of the draw, not a stopwatch.

The symbol set is the printable ASCII characters from ! (code 33) through ~ (code 126), with letters and digits removed. That leaves 32 symbols. Printable ASCII in that range is 94 characters, and 94 − 62 = 32.

Frequently asked questions

Does the password leave my browser?: Not by itself. Generation uses Web Crypto on your machine, and the page keeps no copy. A share link puts the password in the URL fragment: that fragment is not sent with the HTTP request, but anyone who has the link can read the password.
Is the entropy a crack time?: No. Entropy counts the size of the random draw. How long an attack takes also depends on the hashing scheme and on the hardware. The same 60-bit password is a different problem behind a slow password hash than it is in a fast hash or in clear text.
Can I paste my own password and have it scored?: No. The meter is the entropy of a uniform draw from the alphabet you selected. A password you invented needs a different kind of estimate, because people reuse words and patterns.
Should I memorize what this page generates?: A long random password is a poor thing to memorize. Generate it, put it in a password manager, and keep the manager’s own secret somewhere you can remember. This page is not that manager.