Strong password generator

Every password is generated in your browser with crypto.getRandomValues, the cryptographically secure random number generator built into modern browsers. Characters are chosen without bias (using rejection sampling), and the password is never sent anywhere or stored.

You choose the ingredients:

Character set	Characters	Count
Lowercase	a–z	26
Uppercase	A–Z	26
Numbers	0–9	10
Symbols	! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . ? / ~	25

Each selected set appears at least once, so a password with all four boxes checked always has a lowercase letter, a capital, a digit and a symbol, which satisfies most website rules. The positions are shuffled afterwards so the required characters don't sit in predictable places.

Exclude look-alikes removes I, l, 1, O, 0, o and |, which are easy to misread when you have to type a password from paper or another screen.

The strength meter estimates entropy: length × log₂(number of possible characters). Each extra bit doubles the number of guesses an attacker would need.

Bits	Label	Example setting
under 40	Weak	6 lowercase letters (≈28 bits)
40–59	Fair	10 lowercase letters (≈47 bits)
60–79	Strong	12 characters, all types (≈77 bits)
80 and up	Very strong	16 characters, all types (≈103 bits)

Length matters more than complexity. Going from 12 to 16 characters adds more strength than adding symbols to a 12-character password. Current NIST guidance likewise puts the emphasis on length rather than forced complexity rules.

The estimate assumes the password is truly random, as it is here. A password you invent yourself, like Summer2026!, is far weaker than its length suggests, because attackers try common words and patterns first.

• Use a password manager. It remembers a different random password for every site, so you only have to remember one strong master password.
• Never reuse passwords. When one site is breached, attackers try the same email and password everywhere else.
• Turn on two-factor authentication (an authenticator app or security key) for email, banking and social media.
• Change a password when a service reports a breach, or if you suspect someone else knows it.
• Don't send passwords in plain chat or email. If you must share text securely, encrypt it and share the key another way.

Save the generated password in your password manager before you close or reload the page; it is not stored anywhere.

• Wi-Fi passwords: 16–20 characters without look-alikes are both strong and practical to type on a TV or game console.
• Sites with symbol restrictions: uncheck Symbols and increase the length to compensate. 20 letters and digits give about 119 bits.
• PINs and number-only codes: check only Numbers. Remember that a 6-digit PIN has only a million combinations, so it relies on lockouts to stay safe.
• Several accounts at once: set the count to 5, 10 or 20 and use Copy all.

Use Hide to mask the passwords on screen if someone is looking over your shoulder; copying still works.