How to use the Password Generator
- Copy the password shown, or click Generate for another.
- Drag the length slider — 16 or more is a good default.
- Turn character types on or off to match a site’s rules.
- Check the strength meter and estimated crack time before you use it.
What actually makes a password strong
Length beats complexity. Strength is measured in bits of entropy: length × log₂(number of possible characters). Each extra character multiplies the guesses needed; each extra character type only adds a little.
| Password | Entropy | Time to crack* |
|---|---|---|
| 8 chars, lower case only | 38 bits | about 10 seconds |
| 8 chars, all types | 52 bits | about 2 days |
| 12 chars, all types | 77 bits | about 300,000 years |
| 16 chars, all types | 103 bits | longer than the age of the universe |
*Offline attack at 10 billion guesses per second against a fast hash. This is the worst case — online logins with rate limiting are far slower to attack.
How these passwords are made
Each character is chosen with crypto.getRandomValues, your browser’s cryptographically secure random generator, using rejection sampling so no character is more likely than another. Every selected character type is guaranteed to appear at least once, which satisfies most sites’ rules. The password is created on your device and never sent anywhere.
The strongest habit is not the password itself but using a different one for every account, stored in a password manager.
Frequently asked questions
Is it safe to generate a password on a website?
It is safe here because the password is generated in your browser and never transmitted — the page works with your internet disconnected. Avoid any generator that creates passwords on a server.
How long should my password be?
At least 12 characters with mixed types, and 16 or more for important accounts like email and banking. If you use a password manager, 20+ costs you nothing.
What does “exclude ambiguous characters” do?
It removes characters that look alike — I, l, 1, O, 0 and similar punctuation — so a password you have to read or type by hand is not mistyped. It slightly reduces entropy, which a longer length makes up for.