Skip to content
ToolMoose

Password Generator

Create strong, random passwords with your choice of length, letters, numbers and symbols.

464
Include
Your password
···
StrengthVery strong

About 103 bits of entropy from a pool of 86 characters. More length adds strength faster than more symbols.

Generated in your browser with the built-in cryptographic random number generator. Nothing is sent over the network, logged or stored.

Worked examples

16 characters, everything on
The default: lowercase, uppercase, numbers and symbols over 16 characters gives roughly 100 bits of entropy, rated Very strong, like k7#mQ2vjnL9!xWc4 (illustrative).
20 characters, letters and numbers only
Turn symbols off for sites that reject them and bump the length to 20 to keep the strength high, like h8Kp3mWq7nR2xVt9bLc.
Exclude look-alikes
Tick 'Exclude look-alikes' to drop I, l, 1, O, 0 and o so a password you have to read off a screen or type by hand is not ambiguous.
Short PIN-style
Numbers only at length 6 produces a random 6-digit code, useful as a throwaway PIN, though it is Weak for anything important.

How the password generator works

A strong password is simply a long string of characters that an attacker cannot predict. This tool builds one entirely in your browser: you pick the length and which character types to include, and it draws each character at random from that pool.

The randomness comes from the Web Crypto API (crypto.getRandomValues), the browser’s cryptographically secure random number generator. This is the same source used to generate real encryption keys. It deliberately does not use Math.random(), which is fast but predictable and unsuitable for anything security related.

The character pool

You choose any combination of four sets:

  • Lowercase a-z (26 characters)
  • Uppercase A-Z (26 characters)
  • Numbers 0-9 (10 characters)
  • Symbols !@#$%^&*()-_=+[]{};:,.?/ (24 characters)

With all four enabled the pool is 86 characters. Every position in the password is an independent random pick from that pool, and the generator guarantees at least one character from each set you selected (as long as the length allows), so the result always satisfies the rules you chose.

Excluding look-alikes

Tick Exclude look-alikes to remove the six characters that are easiest to misread: I, l, 1, O, 0 and o. This is useful for passwords you have to read off a screen and type by hand, for example a Wi-Fi key or a device setup code. It shrinks the pool slightly, which the strength meter accounts for.

How strength is measured

The strength meter shows entropy in bits, calculated as:

bits = length × log2(pool size)

Each bit of entropy doubles the number of guesses an attacker would need. A 16-character password drawn from an 86-character pool has about 16 × log2(86) ≈ 103 bits, which is comfortably in the “very strong” range. The rough scale used here:

  • Under 40 bits: Weak
  • 40 to 60 bits: Fair
  • 60 to 80 bits: Strong
  • 80 to 120 bits: Very strong
  • 120 bits and up: Excellent

The key takeaway: length beats complexity. Adding one more character multiplies the possibilities by the full pool size, while swapping one letter for a symbol barely moves the needle. If a site rejects symbols, just make the password longer.

Privacy

Everything happens on your device. The password is generated by JavaScript running in your tab, never sent to a server, never logged and never stored. Refreshing the page or closing the tab discards it completely.

Good password habits

  • Use a unique password for every account so one breach cannot cascade.
  • Store them in a reputable password manager rather than reusing or memorizing.
  • Prefer length (16+ characters) over hard-to-remember complexity.
  • Turn on two-factor authentication wherever it is offered, as a second layer beyond the password itself.

This tool generates passwords for your own use. It is a convenience utility, not professional security advice.

Frequently asked questions

Are these passwords really random and safe?
Yes. Every password is built in your browser using the Web Crypto API (crypto.getRandomValues), the same cryptographically secure random source browsers use for encryption keys. It never uses Math.random, which is predictable. Nothing you generate is sent over the network, logged or stored, so once you close the tab it is gone.
How long should my password be?
Length matters more than anything else. Twelve characters is a reasonable floor, sixteen or more is comfortably strong, and for accounts you never type by hand (stored in a password manager) longer is always better. Each extra character multiplies the number of possible passwords, so length adds strength far faster than swapping in a few symbols.
What is entropy and how many bits do I need?
Entropy measures how unpredictable a password is, in bits. Each bit doubles the number of guesses an attacker needs. As a rough guide: under 40 bits is weak, 60 to 80 is strong for everyday accounts, and 100 bits or more is excellent and effectively uncrackable by brute force. The tool shows the bit count for your current settings.
Should I turn on symbols?
If the site allows them, yes, because a larger character pool means more entropy per character. But some sites reject certain symbols. When that happens, turn symbols off and add a few more characters of length instead, which recovers the lost strength without the compatibility headache.
What does 'exclude look-alikes' do?
It removes characters that are easy to confuse in many fonts: capital I, lowercase l, the digit 1, capital O, the digit 0 and lowercase o. This is handy when you have to read a password off one screen and type it into another. It slightly shrinks the character pool, so the strength meter updates to reflect that.
Can I reuse one strong password everywhere?
No. A unique password per account is the single most important habit, because one leaked site should not compromise the others. Generate a separate password for each login and store them in a reputable password manager rather than trying to remember them all.

Related tools

Username GeneratorGenerate catchy, unique usernames from adjectives, nouns, numbers and your own keyword.Random Name GeneratorGenerate realistic random first and last names, with gender and quantity options.Binary TranslatorConvert text to binary and decode binary back to readable text, instantly.

Last updated: 2026-07-01