How strong should a password be?

Aim for at least 70–100 bits of entropy. This tool estimates entropy as length × log2(character pool), which tells you how hard brute force would be.

Where does the randomness come from?

From the browser's secure crypto.random values, not Math.random — the same quality of randomness used for TLS keys.

How long should my password be?

Use at least 16 characters for important accounts and 20 or more for high-value ones. Length matters more than complexity formulas: every extra character multiplies the search space. Generate a unique password per site and store it in a password manager.

Should I include symbols?

Symbols enlarge the character pool and therefore the entropy, but some sites reject them or handle them awkwardly on mobile. Include them when allowed; excluding ambiguous characters reduces transcription errors without weakening long passwords much.

Are generated passwords saved anywhere?

No. A new password is generated in your browser each time the options change, and nothing is stored or sent to a server. Save it in your password manager before closing the page — there is no history to recover it from.

Can I use this for API keys and tokens?

Yes. Generate a long random string — 32 characters or more — with all character sets enabled, then store only a hash of it on the server. Treat it like a password: one key per service, never reuse it and rotate it if it leaks.

Password Generator

Generate strong random passwords with a strength estimate.

Frequently asked questions

How strong should a password be?: Aim for at least 70–100 bits of entropy. This tool estimates entropy as length × log2(character pool), which tells you how hard brute force would be.
Where does the randomness come from?: From the browser's secure crypto.random values, not Math.random — the same quality of randomness used for TLS keys.
How long should my password be?: Use at least 16 characters for important accounts and 20 or more for high-value ones. Length matters more than complexity formulas: every extra character multiplies the search space. Generate a unique password per site and store it in a password manager.
Should I include symbols?: Symbols enlarge the character pool and therefore the entropy, but some sites reject them or handle them awkwardly on mobile. Include them when allowed; excluding ambiguous characters reduces transcription errors without weakening long passwords much.
Are generated passwords saved anywhere?: No. A new password is generated in your browser each time the options change, and nothing is stored or sent to a server. Save it in your password manager before closing the page — there is no history to recover it from.
Can I use this for API keys and tokens?: Yes. Generate a long random string — 32 characters or more — with all character sets enabled, then store only a hash of it on the server. Treat it like a password: one key per service, never reuse it and rotate it if it leaks.

About this tool

This password generator creates random passwords from the browser's cryptographic random source and estimates their entropy in bits. Length and character variety determine how long a brute-force attack would take; every option is applied locally, so generated passwords never travel over the network.

How to use it

Set the password length — 16 characters or more is a good default.
Choose which character sets to include: uppercase, lowercase, digits and symbols.
Optionally exclude ambiguous characters such as I, l, 1, O and 0.
Copy the generated password into your password manager.

← All tools