About this random password generator
This password generator makes a random password of 6 to 64 characters from the character sets you pick, shows a strength label and the password's entropy in bits, and lets you copy it with one click. It runs entirely in your browser: the password is created on your device and is never sent to a server. A new one appears whenever you change a setting.
How the passwords are generated
The script first builds a pool from the sets you have ticked, leaving out characters that are easy to misread: 24 uppercase letters (no I or O), 24 lowercase letters (no l or o), 8 digits (2 to 9) and 18 symbols, !@#$%^&*()-_=+[]{}. With all four on, the pool holds 74 characters.
It then asks crypto.getRandomValues() for random 32-bit numbers. MDN describes these as "cryptographically strong random values", unlike Math.random(). Each number picks one character from the pool, using rejection sampling. 232 is not a multiple of 74 (it leaves a remainder of 44), so taking each number modulo 74 would make the first 44 characters slightly more likely. The page avoids this by throwing away any number at or above 4,294,967,252, the largest multiple of 74 below 232, and drawing again. That happens about once in 98 million draws, and it leaves every character equally likely at every position.
Each position is drawn independently. The tool does not force one character from every set. As a result, about 17% of 16-character passwords from the full pool contain no digit at all. If a site insists on one, generate again.
Password strength: entropy by length and character set
For a password picked at random, strength is measured as entropy: log2(NL) bits, where N is the pool size and L the length, which is the same as L × log2(N). Each extra bit doubles the guesses an attacker needs. The values below were computed from this tool's pool sizes:
| Length | Lowercase only (24) | Upper + lower (48) | Letters + digits (56) | All four sets (74) |
|---|---|---|---|---|
| 8 | 36.7 bits | 44.7 bits | 46.5 bits | 49.7 bits |
| 12 | 55.0 bits | 67.0 bits | 69.7 bits | 74.5 bits |
| 15 | 68.8 bits | 83.8 bits | 87.1 bits | 93.1 bits |
| 16 | 73.4 bits | 89.4 bits | 92.9 bits | 99.4 bits |
| 20 | 91.7 bits | 111.7 bits | 116.1 bits | 124.2 bits |
| 24 | 110.0 bits | 134.0 bits | 139.4 bits | 149.0 bits |
| 32 | 146.7 bits | 178.7 bits | 185.8 bits | 198.7 bits |
A 16-character lowercase password (73.4 bits) is within about one bit of a 12-character password using every set (74.5 bits). Adding length is the cheapest way to add strength. These figures only hold for generated passwords; a password you invent yourself is far more predictable than its length suggests.
Worked example
When the page loads, the length is 16 and all four sets are on. The pool is 74 characters, so there are 7416, about 8.1 × 1029, possible passwords, and log2(7416) = 99.4 bits. The panel shows Strong and 99.4 bits. Untick Symbols and it drops to 92.9 bits; length 6 with lowercase only gives just 27.5 bits, about 191 million possibilities.
What the strength label means
The label is a simple rule. It shows Strong for 12 or more characters using at least three sets, Moderate for 8 or more characters using at least two, and Weak otherwise.
What NIST SP 800-63B-4 says
The US National Institute of Standards and Technology sets password rules for federal systems in SP 800-63B-4 (Revision 4, July 2025). Its password verifier section says services "SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length", and at least eight when the password is one part of multi-factor login. They "SHOULD permit a maximum password length of at least 64 characters", "SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types)", and "SHALL NOT require subscribers to change passwords periodically" unless there is evidence of compromise. New passwords must be checked against a blocklist of common or breached ones.
Passphrases vs random strings
NIST's appendix on password strength notes that "the use of passphrases (i.e., passwords with multiple words) is often an effective way to create a longer password." The words must be chosen at random, not taken from a quote or lyric. The EFF long wordlist has 7,776 words, worth about 12.9 bits each, so six random words give about 77.5 bits, close to a random 13-character password from the full pool here (80.7 bits). A passphrase is easier to type and remember, so it suits the few passwords you enter by hand, such as a password manager's master password. For everything else, a random string kept in a manager is just as strong. This tool makes random strings, not passphrases.
Why use a password manager
For most people the bigger risk is not a strong password being guessed but one password being reused, so a breach at one site opens others. A password manager makes a different password for every account practical: it stores them encrypted and fills them in. NIST says verifiers "SHALL allow the use of password managers and autofill functionality".
What "nothing is sent" means
Some generators create the password on a server and send it back, so it passes through that server and possibly its logs. Here the generating code is already in the page, and generation makes no network request. The password is not put in the address bar or saved in browser storage; it disappears when you close or reload the tab. You can check this: open your browser's developer tools (F12), choose the Network tab and press Generate. No new request appears. The page's analytics and ad scripts make their own background requests at other times; what matters is that nothing fires when you generate. One caveat: after you press Copy, the password sits on your clipboard, and some clipboard history tools keep it. Paste it into your manager, then copy something else.
Common mistakes and limits
- Editing the result by hand. Swapping in a word or a birth year adds a guessable pattern.
- Treating a hash as a password. A SHA-256 digest from the Hash Generator is a fingerprint of text you typed, not new randomness. For a random identifier rather than a secret, the UUID Generator makes version 4 UUIDs.
- Sites with limits. Some older systems cap the length or reject certain symbols. Turn Symbols off and add length to make up the difference.
Frequently asked questions
Yes. The tool uses crypto.getRandomValues(), the browser's cryptographically secure random source, rather than Math.random(). It maps each random number to a character with rejection sampling, so every character in the pool is equally likely at every position.
No. The password is generated and displayed in your browser, and generating one makes no network request. It is not saved in browser storage or put in the page address, and it is gone when you close or reload the tab.
NIST SP 800-63B-4 sets a minimum of 15 characters for a password used on its own and 8 for one used with a second factor. The default of 16 characters from all four sets gives about 99.4 bits of entropy, and longer is better if the site allows it.
For a randomly generated password, strength is entropy: log2(N^L) bits, where N is the pool size and L the length. A 16-character password from this tool's 74-character pool has about 99.4 bits. The Strong, Moderate or Weak label is a simpler rule based on length and the number of character sets.
The tool always leaves out I, O, l, o, 0 and 1, so a password can be read or typed without confusing look-alike characters. That makes the pool 74 characters instead of 80, which costs about 0.1 bits per character.
No. NIST SP 800-63B-4 says services shall not impose composition rules such as requiring mixtures of different character types. It focuses on length instead, plus checking new passwords against a blocklist of common or breached passwords.
Not necessarily stronger, but easier to type and remember. Six words picked at random from the EFF long wordlist of 7,776 words give about 77.5 bits, similar to a random 13-character password from this tool's full pool (80.7 bits). Use a passphrase for the few passwords you type by hand and random passwords in a password manager for the rest.
Each character is drawn independently from the whole pool, so the tool does not force one digit or symbol. About 17% of 16-character passwords from the full pool contain no digit. If a site requires one, generate a new password.