Is this password generator safe?

Passwords are generated locally with the browser's cryptographic random source and are never transmitted. Still, avoid using any online tool on a device you do not trust.

How long should a password be?

For accounts you protect with a manager, 16 or more random characters is a comfortable default. See the blog article on password length for the reasoning.

Are symbols necessary?

They increase the character set, but length matters more. A long password without symbols can be stronger than a short one with them. Use symbols when a site requires them.

What are ambiguous characters?

Characters that look alike, such as l, 1, I, O and 0. You can exclude them if you will read the password aloud or type it by hand.

Password Generator

Create strong random passwords in your browser, with adjustable length and character sets.

Updated September 19, 2026Checked by the editorial team

Your password

–

Length: 20

Generated in your browser with the Web Crypto random generator. Nothing is sent or stored.

Set a length, choose which kinds of characters to include and copy a fresh random password. Generation happens in your browser using the cryptographic random number generator built into it, and the password is never sent to a server or stored.

A password manager is the best place to keep the result. Use a different password for every account.

How password generator works

Each character is picked independently and uniformly from the set you allow, using rejection sampling so that no character is more likely than another. The strength estimate is the number of bits of entropy: the length multiplied by log₂ of the size of the character set.

Entropy describes a random password. A password you invent yourself, or one built from a pattern, is much weaker than its length suggests.

The formula

Entropy (bits)  =  length × log₂(size of character set)
12 characters from 94 symbols  ≈  78.7 bits
16 characters from 94 symbols  ≈  104.9 bits

Each extra bit doubles the number of guesses an attacker needs on average.

Worked example: how length and variety compare

12 lowercase letters: 12 × log₂(26) = 56.4 bits.

12 characters from letters, digits and symbols: 78.7 bits, about four million times harder to guess.

Adding four more characters to reach 16 gives 104.9 bits.

When to use this tool

Creating a password for a new account before saving it in a manager.
Generating a Wi-Fi key, a database password or an API secret.
Replacing a password that was reused or exposed in a breach.

Common mistakes to avoid

Reusing one strong password across many sites. A breach at one exposes all of them.
Making a short password complex instead of long. Length adds more entropy than clever symbols.
Storing passwords in a plain text note or an email to yourself.
Choosing a site's maximum length by default. Where a site allows it, use at least 16 characters.

Frequently asked questions

Is this password generator safe?: Passwords are generated locally with the browser's cryptographic random source and are never transmitted. Still, avoid using any online tool on a device you do not trust.
How long should a password be?: For accounts you protect with a manager, 16 or more random characters is a comfortable default. See the blog article on password length for the reasoning.
Are symbols necessary?: They increase the character set, but length matters more. A long password without symbols can be stronger than a short one with them. Use symbols when a site requires them.
What are ambiguous characters?: Characters that look alike, such as l, 1, I, O and 0. You can exclude them if you will read the password aloud or type it by hand.

Learn more

Results are for information only and are not financial, legal or medical advice. The calculation logic is covered by automated tests, and examples on this page are worked out and re-checked before publishing. Spotted a mistake? Tell us.