Password Generator
Password generator: strong random passwords with a live strength meter, custom length and character sets. Free, no sign-up, and it runs in your browser.
Dedicated page: /en/password-generator
History (this session only)
Passwords you generated on this page. Stored only in this tab's memory: reload the page and they are gone.
Nothing yet. Generate a password and it will be listed here.
Report an Issue
Found a mistake or a problem with this tool? Tell us below.
Quick answer
A password generator creates strong, random passwords using a cryptographically secure random number generator. Choose the length and character sets, or use pronounceable mode, and the strength meter estimates how long the result would take to crack. Generated here, passwords never leave your browser.
About this Password Generator
Password generator: strong random passwords with a live strength meter, custom length and character sets. It is one of the Security and DNS on ToolUstad, and like every tool here it runs entirely in your browser: nothing you type, paste or open is uploaded to a server, and there is no sign-up or usage limit.
What makes a password strong?
Password strength is mostly about entropy: how many possibilities an attacker must try. A random 16 character password drawn from letters, digits and symbols has around 100 bits of entropy and is effectively uncrackable by brute force. Length beats complexity tricks: four extra characters add far more safety than swapping a letter for a symbol, which is why modern guidance from NIST favours long passwords and passphrases over complicated short ones. Adding just four random characters multiplies the guesses an attacker needs by billions.
How this generator creates passwords
- Uses the browser's cryptographic random source (crypto.getRandomValues), never Math.random.
- Lets you set length from short PIN-style codes up to 64 characters.
- Toggles uppercase, lowercase, digits and symbols, and can exclude lookalike characters like 0 and O.
- Offers a pronounceable mode that builds memorable syllable based passwords.
- Scores each result with a strength meter and estimated crack time.
- Keeps a session only history so you can generate several and pick.
When and why to generate passwords
- Every new account: a unique generated password means one breach cannot unlock your other accounts.
- Shared team logins: generate, store in the team password manager, never invent by typing.
- Wi-Fi, routers and devices: replace the default and the family name passwords.
- API keys and service accounts: long random strings are exactly what machines should use.
Best practices
| Practice | Why |
|---|---|
| 16 or more characters for important accounts | Entropy grows with every character |
| A different password for every site | Stops credential stuffing after breaches |
| Store passwords in a password manager | Humans cannot memorise dozens of random strings |
| Turn on two factor authentication | A stolen password alone is then not enough |
Common mistakes to avoid
- Reusing a favourite password with a changed number at the end.
- Using names, birthdays, teams or keyboard walks like qwerty123.
- Generating a strong password and then emailing it to yourself in plain text.
- Shortening a generated password because a site made the field look small.
Who is the password generator for?
Everyone with accounts, which is everyone: individuals fixing weak passwords, IT staff provisioning users, and developers needing test credentials. Inventing passwords by typing produces patterns humans and cracking tools both recognise; a generator produces genuine randomness, which is the entire point.
Settling the storage question
A generator is only half of the system: the other half is storage. Generated passwords are deliberately unmemorable, so they belong in a password manager (Bitwarden, 1Password, Apple or Google Password Manager) protected by one strong passphrase and two factor authentication. The accounts worth generating for first are the keys to everything else: your primary email, the password manager itself, banking, and any account that can reset the others. Work through those with this generator today, at 16 characters or more, and the largest single risk in most people's digital life, password reuse, is closed in under an hour.
Learn: how to use the Password Generator
- Set the length with the slider. 16 characters is a good default; 20 or more for important accounts.
- Pick your character sets. Leave "exclude similar" on for passwords you may have to read aloud or type from paper.
- Copy the password straight into your password manager. The history list keeps this session's passwords so you can grab an earlier one.
Features
- Length slider from 4 to 64 characters
- Uppercase, lowercase, numbers and symbols toggles
- Exclude similar characters (i, l, 1, L, o, 0, O) and ambiguous symbols
- Pronounceable mode built from syllables, for passwords you must speak or memorise
- Live strength meter with an entropy estimate in bits
- Session history of up to 20 passwords, held in page memory only
Worked example
A 16-character password using all four sets draws from a pool of about 90 characters, giving roughly 104 bits of entropy: rated Excellent, and beyond brute-force reach for any realistic attacker.
Frequently asked questions
Are these passwords generated on a server?
No. They are generated in your browser using the Web Crypto API's secure random number generator, the same source operating systems use. Nothing is transmitted or stored.
How long should a password be?
Length beats complexity. A 16-character random password is strong; for your email and banking, 20 or more is better. Use a unique password per account and store them in a password manager.
Why exclude similar characters?
Characters like l, 1, I and O, 0 are easy to mix up when reading a password off a screen or paper. Excluding them prevents lockouts at a small cost in entropy.
Is a pronounceable password safe?
It is weaker per character than a fully random one, so use a longer length (18 or more). It suits WiFi passwords and anything you read aloud; use fully random passwords elsewhere.
Are passwords generated here sent anywhere?
No. Generation uses your browser's own cryptographic random functions and happens entirely on your device. Nothing is transmitted, logged or stored when you close the tab.
How long should a password be in 2026?
At least 12 characters for ordinary accounts and 16 or more for email, banking and password manager master passwords. With random characters, length is the single biggest contributor to strength.
Is a passphrase better than a random password?
A passphrase of four or more random words is easier to type and remember, and at sufficient length just as strong. Random character passwords suit password managers; passphrases suit the few passwords you must memorise, like the manager's own.
Related tools
More Security and DNS like this one, plus two picks from other categories. Each opens its own dedicated page.