Generate strong passwords that never leave your device
Set the length, choose the character sets, and generate one password or five hundred. Everything comes from your browser's cryptographic random source (0 uploads, works offline) — which is the only sane way to use a password generator, because a password a website has seen is not a secret.
How to use it
- Set the Length — 20 or more is a good default for anything stored in a password manager.
- Tick the character sets you need: lowercase, uppercase, digits, symbols.
- Leave Allow look-alike characters off unless you need it; it excludes
l I O 0 1. - Set How many if you are creating several at once.
- Copy a password, or Download the batch. The entropy figure below tells you how strong they actually are.
FAQ
How do I generate a strong random password for free?
Set a length of 20 or more on this page, leave all four character sets on, and copy the result. Generation uses crypto.getRandomValues in your own browser, so nothing is uploaded and there is no sign-up — and the entropy in bits is shown so you can judge the strength rather than trust an adjective.
Is it safe to use a password generated on a website?
Only if the password is generated on your device and never transmitted, which is the case here — turn off your Wi-Fi and the page still works. A generator that produces passwords on a server has, by construction, sent you a secret that its logs may have seen. That is the whole reason this tool is client-side.
What do the entropy bits mean?
Entropy is log2 of the number of possible passwords your settings can produce. Roughly: under 60 bits is weak against offline cracking, 75 or more is strong, and 100 or more is beyond brute force with current hardware. Length raises it much faster than adding exotic symbols does.
Why are l, I, O, 0 and 1 excluded by default?
Because they are misread. Those five characters are the usual cause of a password that "does not work" when it is typed from a printout or read out over a call. Turn the toggle on if the password will only ever be pasted.
Does every password really contain the sets I picked?
Yes. One character is drawn from each selected set before the rest is filled in, then the whole string is shuffled — so "include symbols" is a guarantee, not a probability. Selection uses rejection sampling rather than a modulo, so no character is quietly more likely than another.
Can I use this for Wi-Fi passwords and API keys?
Yes for both, though for API keys prefer whatever your provider issues. For Wi-Fi, a long password without symbols is often easier — the 20-character no-symbols preset is there for exactly that.
Limits
Length 4 to 256, and 1 to 500 passwords per run. A password shorter than the number of selected character sets cannot contain all of them, and the tool says so rather than silently dropping one. Nothing is remembered between visits — copy what you generate before leaving the page.
Related
The UUID generator uses the same cryptographic source for ids, and the hash generator is the tool to reach for when you need a digest rather than a secret.
Bookmark this page (Ctrl+D, or ⌘D on Mac) or install the app — it works offline the next time you need it.