Overview
Most passwords are weaker than they look, and the reason is rarely the website's fault. People invent passwords from familiar things — names, dates, favourite teams, keyboard walks — and attackers keep long lists of exactly those habits. A generator sidesteps the problem entirely: instead of asking your brain for something random, it asks your browser's cryptographic random number generator, which has no habits, no favourites, and no memory. Every character it picks is independent of the last, so the finished password carries no pattern to discover and no personal detail to exploit.
You still decide the shape of the password. Drag the length slider anywhere from 4 to 128 characters, tick the character families you want — capitals, small letters, digits, symbols — and optionally filter out look-alike characters that cause typos. The page guarantees every selected family appears at least once, and the entropy readout updates live, so you can see precisely how each choice changes the password's strength instead of taking it on faith.
What is a random password?
A random password is one where each character was chosen on its own, with no connection to its neighbours. There is no word hidden inside, no date, no pattern of any kind — just a sequence that could only be reproduced by making the same random choices again. That independence is the entire security story: an attacker can't narrow the search with clever guesses about you, because there is nothing about you in the password.
Strength is measured in entropy — roughly, how many yes-or-no questions an attacker must answer correctly to find your password. Longer passwords and bigger character pools raise that number fast. As a rule of thumb, anything below about 40 bits falls quickly to a determined attacker, 60 to 80 bits is strong for everyday accounts, and past 80 bits you're in very strong territory. Length buys more security per keystroke than exotic symbols, which is why reaching for the longer slider is usually the smartest move.
Features
- Length from 4 to 128 characters. Set it with the slider or type an exact number — both controls stay in sync.
- Four character families. Uppercase, lowercase, digits and symbols can be mixed in any combination you like.
- Look-alike filter. Optionally drops confusing characters like 0, O, 1, l and I so typed passwords don't turn into guessing games.
- Guaranteed coverage. Every character family you select is promised at least one appearance in the result.
- Live entropy readout. Watch the bit count and strength label update the instant you change any setting.
- One-click copy and instant regenerate. Grab the password for pasting, or roll a fresh one without touching the settings.
- Cryptographic randomness. Characters come from your browser's secure random source, not a predictable formula.
Benefits
- No human patterns. The password contains nothing an attacker could guess from knowing you.
- Fits any site's rules. Adjust length and character sets to match whatever the signup form demands.
- Honest strength feedback. The entropy meter shows what you're actually getting, not a vague 'strong' label.
- Private by construction. Generation happens on your device; there is no server to leak or log anything.
Who can use it
Anyone who creates online accounts — which is to say, nearly everyone. It's handy when signing up somewhere new and the site demands a password on the spot, for people replacing one reused password across many sites with unique ones, and for anyone using a password manager who needs strong originals to store. System administrators resetting credentials for colleagues, developers seeding test accounts, and parents setting up devices for kids all get the same benefit: a proper random secret in seconds, without installing anything or trusting a stranger's server with it.
How to use
- Drag the length slider (or type a number) to choose how long the password should be — 16 or more is a comfortable default.
- Tick the character families you want included: uppercase, lowercase, numbers, symbols.
- Turn on the look-alike filter if you'll ever type the password by hand.
- Check the entropy readout and strength label; lengthen the password if the label isn't where you want it.
- Hit 'Copy password' to put it on your clipboard, or 'New password' to roll another one.
Frequently asked questions
How long should my password be?
Longer than feels necessary. Sixteen characters from a decent-sized pool is a solid default for everyday accounts; go longer for email, banking, and anything that guards other accounts. Each extra character multiplies the guessing work enormously, while exotic symbols add comparatively little. If a site caps the length, max it out and switch on all four character families. And whatever length you choose, never reuse the password anywhere else — uniqueness matters as much as length.
Do I actually need symbols in my password?
They help by enlarging the character pool, but they're not magic. A 20-character password of only letters and digits is far stronger than an 8-character one stuffed with symbols. Symbols matter most when a site forces short lengths, because then every bit of pool size counts. The honest answer from the entropy maths: prioritise length first, then variety. If symbols make the password hard to handle, a longer letters-and-digits password is the better trade.
What does the entropy number mean?
It's the strength score, measured in bits. Roughly, it counts how many coin flips' worth of uncertainty stand between an attacker and your password — higher is better. Below about 40 bits, a determined attacker gets in fast. Between 60 and 80 bits you're strong against anything short of a nation-state. Past 80 bits, brute force is effectively off the table. The number updates live so you can see exactly what each setting is worth.
Can I use a generated password for my bank or email?
Yes — that's exactly what they're for. Important accounts deserve the strongest passwords you have, and a random 20+ character password stored in a password manager is the gold standard. The one thing to avoid is memorising it: let the manager remember, and keep a secure recovery method for the manager itself. Never share the password by email or chat, and make sure the account also has two-factor authentication switched on.
Does this tool remember or send my password anywhere?
No. The password is generated inside your browser tab using your device's own random number generator. It is never transmitted over the network, written to a log, or stored in a cookie. When you close or refresh the page, it's gone — which is why you should copy it into a password manager before navigating away. If a 'generator' ever asks you to create an account first, that's a red flag; this one needs nothing from you.
Why would I exclude look-alike characters?
Because 0 and O, or 1, l and I, are genuinely hard to tell apart in many fonts — and a password you mistype three times gets changed to something weaker out of frustration. If you'll ever read the password off one screen and type it into another, or dictate it over the phone, filtering look-alikes removes a whole category of errors. The strength cost is tiny. If the password goes straight from the copy button into a password manager, you can safely leave them in.
Conclusion
A good password is one you never had to invent. Set a generous length, switch on the character families you need, glance at the entropy readout, and let the generator do the part humans are bad at. Copy the result into a password manager, give every account its own unique password, and you'll have quietly fixed the single most common security mistake on the internet.