Password Generator

Five candidate passwords per click, generated with crypto.getRandomValues() - the browser's cryptographically secure source, with rejection sampling so no character is statistically favored (the classic modulo-bias bug in naive generators). Lookalike characters (I l 1 O 0) are excluded, because a password you cannot retype from a screen is a password you will weaken by hand. The entropy line does the honest math: length × log₂(alphabet size). Aim for 75+ bits on anything that matters. NIST's digital identity guidelines put the effort in the same place: length over composition rules, and no arbitrary expiry. Generated passwords exist only in this tab; the only copy is the one you take.

How to use the password generator

1. Type a length into the Length (8-128) box. If you leave it empty, the tool uses 20.
2. Leave include symbols checked to add 13 punctuation characters to the pool, or uncheck it for letters and digits only.
3. Press Generate. The Passwords out box shows five independent passwords, a blank line, and a line such as ~122 bits of entropy each.
4. Select the one password you want and copy it into your password manager or the signup form. Copy result copies all five lines plus the entropy line, which is rarely what you want to paste into a password field.

Where the entropy number comes from

Each character is picked independently and uniformly from a fixed pool. Without symbols the pool has 57 characters: 24 uppercase letters (no I or O), 25 lowercase letters (no l), and the 8 digits 2 through 9. With symbols checked, !@#$%^&*-_=+? are added, for 70 in total.

Entropy per character is log₂ of the pool size: about 5.83 bits for 57 characters and 6.13 bits for 70. Multiply by the length and round down, and you get the number the tool prints. An attacker who knows exactly how the password was made still has to search that many bits of possibilities, so 2 to the power of the entropy is the size of the haystack.

Two things follow from the table. First, symbols add less than you might expect: 21 characters without symbols (122 bits) match 20 characters with them. When a site dislikes punctuation, one extra character makes up the difference. Second, this math only holds for passwords a machine picked at random. A human-chosen password of the same length has far less real entropy, because people pick words, dates, and patterns that attackers try first.

The random numbers are unbiased too. The generator draws 32-bit values and throws away any at or above 4,294,967,250, the largest multiple of 70 that fits (or the matching multiple of 57), so the remainder maps evenly onto the pool. With 70 characters only 46 of the 4.29 billion possible draws are ever discarded.

A worked example

Set the length to 16, keep symbols on, and press Generate. The characters change every time, but the output looks like this:

q7Vx#pK2m=tRw9hE
Hn4@zdY8-kLs!B3f
bT6?rWgm2e_ZcQ9u
Ja%8vN3hsx+Fk7Dp
e5$RyGq@4nBwz^Tm

~98 bits of entropy each

All five are equally strong, so pick whichever one suits the site. Not every password will contain every kind of character. Because each position is chosen independently, a 16-character password from this pool has roughly a 14% chance of containing no digit and about a 4% chance of containing no symbol. That is expected randomness, and it is why you get five to choose from.

Common problems and fixes

A site says the password needs a number or symbol

The generator does not force one of each character class into every password. Look over the five candidates and pick one that has what the site requires, or press Generate again.

A site rejects certain symbols

Some forms only allow a short list of punctuation, and a few break on characters like & or %. Uncheck include symbols and add one or two characters to the length to keep the same strength.

A site has a maximum length

Some older systems cap passwords at 16 or 20 characters and may silently cut off anything longer, so the password you saved no longer matches. Generate at the site's maximum instead of pasting a longer one.

"Use a length of at least 8" or "Capped at 128 characters."

The first appears for lengths below 8 or input that does not start with a digit. The second appears above 128. Enter a whole number in range.

You need to type it on a TV or phone keyboard

Symbols often sit behind extra menus on those keyboards. Uncheck symbols and use a longer length. Lookalike characters are already removed, so reading it off another screen is manageable.

Related tasks

For unique identifiers rather than secrets, use the UUID generator. To see why passwords are stored as slow, salted hashes and not plain digests, compare with the SHA-256 hash generator.

Questions this tool gets asked

How random are these really?

They come from the Web Crypto API, the same secure random source browsers use for TLS key material, with rejection sampling to remove modulo bias. Generators built on Math.random() are predictable and unsuitable for passwords.

What length should I use?

16 characters is a sensible floor for accounts that matter; 20+ costs you nothing when a password manager does the remembering. The entropy line tells you exactly what each length buys.

Why are I, l, 1, O and 0 missing?

They are visually ambiguous in most fonts. Removing them costs about 0.1 bits of entropy per character and eliminates the most common transcription errors - a trade every good generator makes.

Should I use a password or a passphrase?

For anything typed by hand regularly, a diceware-style passphrase is kinder to memory. For everything stored in a password manager - which should be nearly everything - random strings like these are denser and stronger per character.

Related tools

• cron explainCrontab syntax explained, with the next five real run times.
• regex testPattern on line 1, text below - every match and group listed.
• uuid v4Cryptographically random UUID v4s, one or a thousand at a time.
• sha hashSHA-256, SHA-1, and SHA-512 digests of any text, computed locally.