Hashes/Crypto
Password Generator
Cryptographically random passwords with configurable length and character set.
This generator draws from a cryptographically secure source of randomness (the Web Crypto API) right in your browser. No password ever leaves your device or reaches a server.
How to use it
- Pick a length — longer is always stronger; 16+ characters is enough for most services.
- Turn on the character sets you need: uppercase, lowercase, digits, symbols.
- Exclude easily confused characters (0/O, 1/l/I) if you'll need to type the password by hand.
What makes a password strong
Strength comes from entropy — length and the size of the character set — not from how "complicated" a password looks to a person. A long password made only of lowercase letters is often stronger than a short one mixing every character type.
Where it's supported, turning on two-factor authentication does more for an account's security than relying on password length alone.
Things to keep in mind
Don't reuse the same password across services — a breach on one account shouldn't put the others at risk.
Store passwords in a password manager, not in a text file or notes app.
Article about this tool: Password Generator: what actually makes a password strong
Frequently asked questions
What actually makes a generated password strong?
Length matters more than complexity — a longer password drawn from a large character set has more possible combinations, making it harder to brute-force, even without unusual symbols.
Is it safe to use this to generate passwords for real accounts?
Yes. Passwords are generated locally in your browser using a cryptographically secure random source — nothing is sent to a server or stored anywhere.
Why exclude ambiguous characters like l, 1, O, and 0?
These characters can look identical in some fonts, which makes passwords error-prone to type or read aloud. Excluding them trades a small amount of entropy for fewer transcription mistakes.
Is a passphrase made of words better than random characters?
For passwords stored in a password manager, random characters give higher entropy per character. But for a "master password" that has to be memorized by hand, a passphrase made of several random words is often more practical — it's easier to remember at comparable or higher entropy.
Can I trust a password generator built into a browser or password manager?
Yes, as long as it uses a cryptographically secure source of randomness (the Web Crypto API or equivalent), rather than a plain Math.random() or similar pseudo-random number generators unsuited for security purposes.