How long should a password be?

At least 16 characters for accounts you care about. Length adds more strength than complexity, and a password manager means you do not have to remember it.

Are the passwords sent to a server?

No. They are created in your browser using crypto.getRandomValues and never leave your machine.

A measure of how hard a password is to guess, in bits. Each extra bit doubles the work of a guessing attack. Around 80 bits or more is strong.

Why exclude ambiguous characters?

Characters such as I, l, 1, O and 0 look alike. Excluding them helps when a password has to be read out or typed from paper.

Random Password Generator

Generate strong random passwords in your browser. Pick the length and character sets, exclude ambiguous characters and see the entropy.

How to use it

Drag the slider to set the length, tick the character sets you want and choose how many to make. Each password includes at least one character from every set you pick.

About this tool

Passwords are generated in your browser with the Web Crypto API, so they are not sent anywhere. The entropy shown is the length multiplied by the log of the number of possible characters.

Frequently asked questions

How long should a password be?: At least 16 characters for accounts you care about. Length adds more strength than complexity, and a password manager means you do not have to remember it.
Are the passwords sent to a server?: No. They are created in your browser using crypto.getRandomValues and never leave your machine.
What is entropy?: A measure of how hard a password is to guess, in bits. Each extra bit doubles the work of a guessing attack. Around 80 bits or more is strong.
Why exclude ambiguous characters?: Characters such as I, l, 1, O and 0 look alike. Excluding them helps when a password has to be read out or typed from paper.