Generate strong random passwords
Create one or many passwords of any length using your browser’s cryptographically secure random generator. Choose character sets, exclude look-alike characters and see the entropy in bits. The passwords exist only on your screen.
How to use the Password Generator
- Set the length (16+ recommended) and how many passwords you want.
- Tick the character sets the site allows.
- Click Generate.
- Copy one into your password manager.
What makes a password strong
Strength is measured in entropy: the number of equally likely possibilities an attacker must try. It depends on length and the size of the character pool, not on how "random" it looks. A 16-character password from 94 printable characters has about 105 bits of entropy; at a trillion guesses per second it would take longer than the age of the universe to exhaust. A 8-character password from the same pool (52 bits) can fall in hours to a modern GPU rig against a leaked hash. Length matters more than symbols: 20 lowercase letters (94 bits) beat 10 mixed characters (66 bits).
How randomness is generated
The tool uses crypto.getRandomValues, the browser's cryptographically secure generator backed by the operating system, and rejection sampling to avoid modulo bias. It does not use Math.random(), which is predictable and unsuitable for secrets. Generation happens entirely on your device; no password is ever transmitted.
Practical advice
- Use a password manager and a unique password per site; reuse is how most accounts are breached.
- Turn on two-factor authentication where offered.
- If a site limits length or symbols, untick the sets it rejects rather than editing the password by hand.
- "Exclude look-alikes" helps when a password must be read aloud or typed from paper.
Passphrases
For passwords you must memorise (a laptop login, a manager master password), a passphrase of 5–6 random dictionary words is easier to remember at similar entropy. A word-based generator is on our roadmap.
Frequently asked questions
Are the passwords stored or sent anywhere?
No. They are generated in your browser and disappear when you close or clear the page.
How long should a password be?
At least 16 characters for anything important. Longer is always better if the site allows it.
Is this generator truly random?
It uses the browser’s cryptographic random source (the same one used for TLS keys), with unbiased sampling.
Can I generate a PIN?
Yes: untick everything except Digits and set the length to 4–8.
Privacy
This tool runs entirely inside your browser using WebAssembly and the Canvas/File APIs. Your files are never uploaded to ToolFlint or any third party; you can verify this in your browser's network tab or by switching to airplane mode after the page loads. Read how we process files.
Last updated 2026-09-23.