Password Generator
Strong random passwords, generated in your browser. Never transmitted, never stored.
What "strong" actually measures
Strength is entropy — how many equally likely passwords an attacker would have to work through — and it comes from two numbers only: the size of the alphabet and the length. Each character drawn from an 82-character set contributes about 6.4 bits, so a 20-character password is worth roughly 127 bits. The figure under the output box is that calculation, not a colour-coded guess.
This is why the usual advice is upside down. Adding a symbol to an 8-character password buys you a few bits. Adding four more characters buys you twenty-five. Length is the lever.
| Length | Lower + digits (36) | Mixed case + digits (62) | All four sets (82) |
|---|---|---|---|
| 8 | 41 bits | 47 bits | 50 bits |
| 12 | 62 bits | 71 bits | 76 bits |
| 16 | 82 bits | 95 bits | 101 bits |
| 20 | 103 bits | 119 bits | 127 bits |
| 32 | 165 bits | 190 bits | 203 bits |
Anything at or above about 80 bits is beyond offline brute force with current hardware. The default here is 20 characters with all four sets, which is comfortably past that and still short enough to type out when you have to.
What the current guidance says
NIST finalised revision 4 of its digital identity guidelines (SP 800-63B-4) on 31 July 2025, and it is blunter than most corporate password policies:
- Passwords used as a single authentication factor shall be at least 15 characters.
- Composition rules — "must contain one uppercase, one digit, one symbol" — shall not be imposed. They push people toward predictable substitutions without adding meaningful entropy.
- Verifiers shall not require periodic password changes. Force a change only on evidence of compromise.
The generator still guarantees one character from each set you tick, because plenty of sites have not read the guidance and will reject a password without a digit. That guarantee costs a fraction of a bit at these lengths; the entropy shown is the uniform-draw figure.
Options worth understanding
Avoid look-alikes removes I l 1 | O 0 o. Use it for anything that will be read aloud, copied off a screen, or typed from a printed sheet. It shrinks the alphabet, and the entropy figure updates to match — no hidden cost.
Symbols here exclude quotes, backslashes, backticks, commas and spaces. Those are the characters that break shell commands, CSV imports, connection strings and older web forms. What remains is safe to paste almost anywhere.
Why there is no download button
The IMEI and UUID tools on this site let you export a batch as CSV. This one deliberately does not. A file of plaintext passwords on your disk is a liability that outlives its usefulness, ends up in a backup, and gets shared over chat when someone needs one of them. Generate into a password manager, one at a time, and let it hold the secret. Bulk generation is here for provisioning scripts and test accounts, where the passwords are about to be consumed immediately.
Nothing you generate is transmitted anywhere — there is no server to receive it. Confirm it yourself: open your browser's network tab and watch the page make no requests at all while you click Generate.
Common questions
- Where does the randomness come from?
crypto.getRandomValues, your browser's cryptographically secure generator, neverMath.random. Characters are chosen by rejection sampling, so every character in the alphabet is exactly equally likely.- Can the same password come up twice?
- At 20 characters the space is around 2127. You will not see a repeat.
- Is a passphrase better?
- Only if it is long. Four common words is roughly 44 bits — weaker than what this tool produces by default. Passphrases win on memorability, which matters for the handful of passwords you actually have to remember; for everything else, a manager and a random string is stronger.
- Should I change my passwords every 90 days?
- No, and NIST explicitly advises against requiring it. Rotation drives people toward predictable increments. Change a password when there is reason to think it leaked.