Password Generator
Generate Password
How to Use This Password Generator
Reusing one memorable password across every account is how breach headlines become personal problems. I generate a unique random string for each login because memorizing dozens of phrases is impossible—a tool that spits out a strong password in one click makes that manageable.
- Set Password Length. Enter 4 to 128 characters (default 16).
- Choose Character Sets. Toggle uppercase, lowercase, numbers, and symbols—at least one must stay enabled.
- Adjust Exclusions (optional). Exclude similar characters (i, l, 1, O, 0) or ambiguous symbols that break scripts and legacy validators.
- Press Generate. Copy the result with the Copy button and paste into your password manager or signup form.
Store generated passwords in a reputable password manager—never in plain text files or chat logs. For encoding credentials in config files, see Base64 Encode / Decode.
Password Strength and Practical Applications
Random password strength grows with length and character pool size. A 16-character password drawn from four character sets has vastly more combinations than an 8-character dictionary word with a number appended—attackers automate those guesses first.
Combinations ≈ (Character Pool Size)^Length
Generation uses crypto.getRandomValues when your browser supports it—the same cryptographically secure source recommended for security-sensitive randomness. Each click produces an independent password; regenerate until site-specific character rules are satisfied.
Frequently Asked Questions
How long should my password be?
16 characters with mixed character types resist brute-force and dictionary attacks for most use cases. Financial, admin, and encryption keys benefit from 20+ characters. Length matters more than exotic symbols alone.
Are generated passwords stored anywhere?
No. Passwords are created locally in your browser and are not sent to any server. Clear the field or navigate away when finished on shared computers.
Why exclude similar or ambiguous characters?
Similar-character exclusion helps when you must read or type passwords manually (1 vs l, 0 vs O). Ambiguous-character exclusion avoids symbols that break shell scripts, XML, or older password validators.
Is Math.random fallback secure enough?
Modern browsers use crypto.getRandomValues for generation. If fallback activates in an unusual environment, regenerate on a current browser before using the password for sensitive accounts.
Do I need all four character sets checked?
At least one set must be selected. For maximum entropy, keep uppercase, lowercase, numbers, and symbols enabled unless a site restricts certain characters.