Password Generator
Random passwords with charset options and an honest entropy meter
About this tool
Generate random passwords with chosen length and character sets, in bulk if needed, with an honest entropy calculation — bits of randomness, not a decorative color bar. Randomness comes from crypto.getRandomValues with rejection sampling, so every character is drawn uniformly with no modulo bias.
Each enabled character set is guaranteed at least one representative (a policy many sites enforce), then the rest of the password fills uniformly and the whole thing is shuffled — so the guaranteed characters do not cluster predictably at the start.
An ambiguous-character filter drops the look-alikes (0/O, 1/l/I) for passwords a human might ever read aloud or retype from paper. Since generation is local, the passwords exist only on your machine until you put them somewhere.
Frequently asked questions
- What do the entropy bits mean?
- Entropy = length × log2(pool size): the number of equally-likely possibilities an attacker must search. 64-bit entropy withstands casual attack; 80+ bits is strong against offline cracking of fast hashes; 100+ is effectively unguessable. A 16-character password over letters+digits+symbols is ~104 bits.
- Is a long lowercase password better than a short complex one?
- Often yes — length multiplies entropy while extra sets only widen the base of the logarithm. 20 lowercase letters (~94 bits) beat 10 fully-mixed characters (~65 bits). Complexity rules exist mostly to defeat wordlists, which random generation already defeats.
- Is it safe to generate passwords in a browser?
- The randomness (crypto.getRandomValues) is the same CSPRNG native password managers use, and this page performs no network requests with your data. The realistic risks are around what happens after generation: clipboard history, screen sharing, and where you store it.
- Why exclude ambiguous characters?
- For passwords that will be read by humans — printed recovery codes, spoken over the phone, typed from another screen — 0/O and 1/l/I cause real support tickets. For purely pasted passwords, keep them; the entropy loss from excluding is minor either way.