Password Generator

How It Works

When you click Generate, this tool builds a pool of characters from the sets you selected — uppercase letters, lowercase letters, numbers, and symbols — and picks each character at random using your browser’s built-in cryptographic random number generator (crypto.getRandomValues), the same kind of secure randomness used by banking sites. It deliberately does not use the basic Math.random function, which is predictable and unsafe for passwords. The generator also guarantees that at least one character from every selected set appears in your password, so a password with all four sets checked will always contain an uppercase letter, a lowercase letter, a number, and a symbol.

The strength meter estimates how hard your password would be to guess by brute force. It multiplies the password length by the size of the character pool to estimate entropy, measured in bits: a 16-character password drawn from all four character sets has roughly 105 bits of entropy, which is rated Very Strong. Shorter passwords and smaller character pools score lower — an 8-character password using only lowercase letters has about 38 bits and is rated Weak, because a computer can try every combination far more quickly. Length matters more than complexity: a 20-character password of mixed letters is stronger than a tricky 8-character one.

Use this tool whenever you create a new account, change a compromised password, or set up a Wi-Fi network or encryption key. For example, generating a 20-character password with all four character sets gives you something like k7#Qw9!xP2$mR8tZv4@B — random, unique, and effectively impossible to guess. Because nobody can memorize passwords like that, pair this generator with a password manager (such as Bitwarden, 1Password, or the one built into your browser) that remembers them for you. Never reuse a password: if one site is breached, reused passwords let attackers straight into your other accounts.

Frequently Asked Questions