Random password generator
Choose a length and the characters you need, and get fresh random passwords right away. They are made on your device with the browser's secure random generator, and nothing is uploaded, saved or logged.
8 to 128 characters. Longer is stronger; 16 or more is a good habit.
For sites that reject certain symbols. Type them with no spaces.
Your passwords
Generating...
Copying puts the password on your clipboard, where clipboard history or a synced clipboard may keep it. Paste it where you need it, then copy something else.
How the number is worked out
Entropy in bits = length x log2(number of possible characters). For example 20 characters from 94 gives 20 x 6.55 = about 131 bits. It assumes every character is picked at random, which is what this tool does; it does not apply to passwords a person made up.
Passwords are made in your browser and kept only on this screen. They are not sent anywhere or saved, and they disappear when you leave or reload the page.
How it works
- •Every character is picked with the browser's cryptographic random generator (crypto.getRandomValues), never Math.random. The ordinary random function is predictable and not meant for passwords.
- •Each pick is uniform: bytes that would favour some characters are thrown away and redrawn (rejection sampling), so a plain "remainder" trick cannot make some characters more likely than others.
- •"At least one of each type" puts one character from every selected type in first, fills the rest from the whole pool, then shuffles the lot with the same random source, so the guaranteed characters do not sit in fixed spots.
- •The entropy figure is length x log2(pool size). It describes truly random strings only, and the strength label uses rough cut-offs on that number alone.
Questions
- Is this password generator safe to use?
- The passwords are made in your browser and are not sent or stored by this page; reloading the page makes them disappear. The usual cautions still apply: copying puts a password on the clipboard, where clipboard history or sync may keep it, and a browser extension or malware on your device could still read the screen.
- How long should a password be?
- Length matters most. A random password of 16 characters from the full set has about 105 bits of entropy, far beyond what anyone can guess. For accounts that matter, use a password manager and a different random password for every site; reusing one password is the bigger real-world risk.
- Why does a PIN show such low entropy?
- A 6-digit PIN has only a million possibilities, about 20 bits. PINs work because the phone, card or app locks after a few wrong tries. They would not hold up if someone could try guesses offline without a limit.
- Can I generate memorable passphrases here?
- Not on this page. A good passphrase needs a vetted word list, and this tool sticks to random characters. Passphrasely, our iPhone app, makes both random passwords and word-based passphrases.