About the Strong Password Generator
A strong password is long and unpredictable. This generator builds passwords from the character sets you enable, letters, digits and symbols, using the Web Crypto API's cryptographically secure random number generator, not the predictable Math.random that many online generators use. It guarantees at least one character from each enabled set, so a password is never accidentally all letters.
The status line shows the entropy in bits, a measure of how hard the password is to guess: aim for 70 bits or more for important accounts, which a 16-character password with all sets easily exceeds. You can generate several at once and choose whether to include look-alike characters (l, I, O, 0, 1), which are best excluded for passwords you will type by hand.
Everything happens in your browser and nothing is transmitted or stored, so a generated password is seen only by you. For memorable passwords made of words, use the Passphrase Generator; to store passwords safely in an app, hash them with bcrypt.
How to use
- Set the length and how many to generate.
- Choose which character sets to include.
- Copy a password; the entropy is shown in the status.
Common questions
- Is the randomness secure?
- Yes. It uses the browser's crypto.getRandomValues, a cryptographically secure source, not Math.random.
- Are the passwords sent anywhere?
- No. They are generated in your browser and never transmitted or logged.
- How long should a password be?
- For important accounts, 16 characters or more with mixed sets gives well over 70 bits of entropy, which is very hard to brute-force.
- Why exclude look-alike characters?
- l, I, 1, O and 0 are easy to confuse when typing or reading a password aloud. Exclude them for passwords you handle by hand.