Password Generator: Strong Random Passwords

Length: 20 Also exclude these characters

Generate several at once

Generated with your browser's cryptographic random generator. Nothing is sent anywhere and nothing is stored.

Guide: Password Generator

How to generate a strong password

Pick a length, choose which character types to include and copy the result. A new password is made every time you change a setting or press Regenerate. For most accounts a random password of 16 to 24 characters with all four types is a very good choice.

Random characters or a passphrase?

Random characters pack the most strength into the fewest keystrokes, so they suit passwords that a password manager fills in for you. A passphrase such as lake-hermit-skill-sun-hat is easier to type on a phone or to remember, and is the better choice for the few passwords you must know by heart, like your device login or your password manager master password.

Good habits

Use a different password for every account.
Store them in a password manager instead of a note or a spreadsheet.
Turn on two-factor authentication where it is offered.
Change a password only when you suspect a leak, not on a schedule.
Never reuse a generated password somewhere else.

How the random numbers are made

Every character is picked with the browser's cryptographically secure random generator. To avoid a subtle bias, values that would make some characters slightly more likely are discarded and drawn again, so each allowed character is equally likely. The passphrase mode uses a word list of 1,029 simple English words written for this site, which gives about 10 bits per word. Nothing you generate leaves the page.

FAQ

Is this password generator safe to use?

Yes. Passwords are created by your browser using crypto.getRandomValues, the same cryptographic random source used for encryption keys. They are generated on your device and this tool does not send them anywhere or save them.

How long should my password be?

For random characters, 16 or more is a good minimum for normal accounts and 20 to 24 is better for important ones such as email, banking and your password manager. Length adds more strength than extra symbol types.

What is a passphrase and when is it better?

A passphrase is several random words joined together. It is easier to type and remember than random characters. Five words from this tool give about 50 bits and six give about 60 bits of entropy; use 6 or more for anything important.

What does exclude look-alike characters do?

It removes characters that are easy to mix up when reading or typing, such as the capital letter O and the digit 0, or lowercase l, capital I and the digit 1. It is useful for passwords you must type by hand.

What do the entropy bits mean?

Entropy measures how many guesses an attacker needs. Each extra bit doubles the work. About 80 bits resists even very powerful offline attacks, and 100 or more is excellent. The number shown assumes the password was chosen randomly by this tool.

Open-source licences

Passphrase word list (written for 404gang): Original work, no third-party licence