Are generated passwords stored or sent anywhere?

No — everything happens locally in your browser; nothing is transmitted or saved by this tool.

Why does it exclude some similar-looking characters?

The character sets skip a few easily-confused characters, like 0/O and l/1, to reduce transcription errors if you type the password by hand.

How long should a password be?

16 characters or more is a reasonable default for most accounts today; length matters more than complexity for resisting brute-force guessing, so favor a longer password over a shorter, symbol-heavy one.

Should I reuse a strong password across accounts?

No — reusing any password, however strong, means a single breach exposes every account that shares it. A password manager makes unique passwords per account practical.

What length range can I choose?

The length slider runs from 8 to 32 characters, defaulting to 16 — well above the minimum most services still require.

What happens if I uncheck every character type?

The password field goes blank — at least one character type needs to stay checked, since there's nothing left to draw from otherwise.

How is the strength meter calculated?

It's a simple heuristic — the number of character types enabled, multiplied by a bonus for 12+ character length — not a real entropy calculation. Treat 'Weak' as a signal to add more variety or length, not a precise security score.

Does the strength meter check against known leaked passwords?

No — it's a local, offline heuristic based on character variety and length, not a breach-database lookup like some dedicated password managers offer.

Password Generator

About the Password Generator

Generates random passwords in your browser using the Web Crypto API, with adjustable length and character sets, plus a simple strength indicator.

100% Free Runs in Your Browser No Sign-Up Required

How to use it

Adjust the Length slider and choose which character types to include.
Click Regenerate for a new password.
Copy it with the copy button.

Formula

Each character is chosen using crypto.getRandomValues() — the same secure random-number source browsers use for cryptographic operations, not a simple pseudo-random function.

Worked example

With uppercase, lowercase, numbers, and symbols enabled at 16 characters, a typical result looks like qT7#mK2!vN9$wLpZ.

Entropy by length (this tool's 74-character alphabet)

Entropy by length (this tool's 74-character alphabet)
Length	Entropy (bits)	Brute-force resistance
8	49.7	≈132 years to crack offline against a bcrypt-hashed store (Hive Systems, 2026) — that estimate uses a similarly-sized generic alphabet, not verified identical to this tool's 74-character set, so treat it as an illustrative order of magnitude rather than an exact figure for this tool
12	74.5	Each additional character multiplies the search space by 74× — already far beyond any realistic offline attack at this length
16 (default)	99.3	Effectively immune to brute-force guessing with current or foreseeable hardware
24	149.0	Effectively immune to brute-force guessing with current or foreseeable hardware
32 (max)	198.7	Effectively immune to brute-force guessing with current or foreseeable hardware

Recommendations

• Longer beats more complex — a 16-character password is generally stronger than an 8-character one packed with symbols.
• Use a unique password per account; a password manager makes this practical without memorizing dozens of strings.
• Regenerate if a password looks pattern-like to you — it's cryptographically random, but you can always roll again.

Frequently asked questions

It uses the Web Crypto API's secure random number generator, suitable for generating real passwords — not Math.random() or a simple counter.

Related tools

Hash Generator

UUID Generator

Check Digit Validator

QR Code Generator

Base64 Encoder / Decoder

Regex Tester