Password Generator

What makes a password strong?

Two things: length and randomness. A password's resistance to guessing is measured in entropy (bits) — the number of possible passwords an attacker would have to try. Every extra character multiplies the possibilities, which is why a long random password beats a short "clever" one with substitutions every time.

Length beats complexity

Adding one character to a password multiplies the search space far more than swapping an a for an @. A 16-character mix of upper, lower, digits, and symbols has roughly 100 bits of entropy — effectively uncrackable by brute force. Aim for at least 16 characters for important accounts; use the maximum a site allows where you can.

How this generator works

• It uses your browser's cryptographic randomness (crypto.getRandomValues), not the predictable Math.random.
• It guarantees at least one character from each set you enable, so the password always meets "must include a number/symbol" rules.
• The "avoid ambiguous" option removes look-alikes (0/O, 1/l/I) for passwords you'll have to read or type by hand.
• Everything runs in your browser — the password is never sent anywhere.

Using passwords safely

• Never reuse passwords. One breach shouldn't unlock your other accounts.
• Store them in a password manager so length and uniqueness cost you nothing.
• Turn on two-factor authentication — even a perfect password benefits from a second factor.

FAQ

Is it safe to generate a password on a website?

This one is, because it runs entirely client-side — the password is created in your browser and never transmitted. As a rule, only trust generators that work offline/in-browser, and generate critical passwords on a device you control.

What about passphrases?

A string of random words (e.g. four or more) is also strong and easier to remember. Random character passwords pack more entropy per character, which is ideal when stored in a manager.

Is this password generator free, and does it work on mobile?

Yes on both counts. It's free with no sign-up, and because it's just a responsive web page it works in any modern mobile or desktop browser. You can generate as many passwords as you need.

How long should my password be?

Aim for at least 16 characters for important accounts, and use the maximum a site allows where you can. Length adds far more strength than swapping letters for symbols, so a long random string is the most reliable defense against brute-force guessing.

What does the "avoid ambiguous characters" option do?

It removes look-alike characters such as 0/O and 1/l/I from the pool. That makes a password easier to read aloud or type by hand without mistakes — useful for Wi-Fi keys or anything you can't simply copy and paste.

Are these passwords truly random?

Yes. The generator uses your browser's cryptographic randomness (crypto.getRandomValues) rather than the predictable Math.random, so each password is unpredictable and suitable for real security use.