How to generate a strong, random password
This password generator creates random passwords using crypto.getRandomValues(), the browser's cryptographically secure random number generator — the same source used for encryption keys. Choose a length from 4 to 128 characters, pick which character sets to include, exclude characters you don't want, and generate one password or a batch of up to 20.
The strength meter shows the password's entropy in bits so you can see how much each option actually helps. Passwords are generated on your device and never transmitted or stored remotely.
How to use the password generator
- Set the length with the slider. 16 characters is a sensible default; use 20+ for anything important.
- Choose character sets: uppercase, lowercase, digits and symbols (
!@#$%^&*()-_=+[]{}|;:,.<>?). - Optionally list characters to exclude — for example
0O1lIto avoid look-alikes when a password must be read aloud or typed from paper, or quote characters a legacy system rejects. - Choose how many passwords to generate (1, 5, 10 or 20) and copy the one you want.
What makes a password strong
For a randomly generated password, strength is measured as entropy: length × log2(size of the character set). Each extra bit doubles the number of guesses an attacker needs.
| Length | Character set | Entropy | Rating here |
|---|---|---|---|
| 8 | Lowercase (26) | 38 bits | Very weak |
| 12 | Upper + lower + digits (62) | 71 bits | Fair |
| 16 | Upper + lower + digits (62) | 95 bits | Strong |
| 16 | All four sets (88) | 103 bits | Very strong |
| 24 | Upper + lower + digits (62) | 143 bits | Very strong |
Notice that adding length helps more than adding symbols: going from 12 to 16 alphanumeric characters adds 24 bits, while adding symbols to 16 characters adds about 8. That's why current NIST guidance (SP 800-63B) emphasises length and allows long passphrases, rather than forcing complexity rules.
Entropy only applies to truly random passwords. A human-chosen password like Summer2026! has all four character types but is among the first things attackers try.
Good password habits
- Use a password manager (1Password, Bitwarden, KeePassXC, or your browser's built-in manager) and a different random password for every site. Reuse is what turns one breach into many.
- Turn on two-factor authentication, preferably passkeys or an authenticator app rather than SMS.
- For secrets in code — API keys,
JWT_SECRET, database passwords — generate at least 32 random characters, keep them in environment variables or a secrets manager, and never commit them to Git. - For HMAC-signed JWTs (HS256), use a secret of at least 256 bits; a 43-character alphanumeric password from this tool is enough.
Why browser-based generation is safe here
crypto.getRandomValues() is backed by the operating system's secure random source and is suitable for cryptographic use; Math.random() is not. Because generation runs locally, the password exists only in your browser tab until you copy it. The tool's history panel keeps the first password of each batch in your browser's local storage so you can recover it; on a shared computer, clear the history after use. For random identifiers rather than secrets, use the UUID generator.
Frequently asked questions
Are the passwords really random?
Yes. Each character is chosen with crypto.getRandomValues(), the browser's cryptographically secure random number generator, not Math.random().
Is my generated password sent anywhere?
No. Passwords are generated in your browser and never transmitted. The site has no server-side component that could receive them.
How long should my password be?
At least 16 random characters for accounts, and 20 or more for high-value accounts or secrets. Length increases strength faster than adding symbols.
Why exclude characters?
Excluding look-alikes like 0, O, 1, l and I makes passwords easier to read and type by hand. Some older systems also reject certain symbols. Excluding characters slightly reduces entropy, which the strength meter reflects.