Password Generator

Yes. Every character is chosen with crypto.getRandomValues, the browser’s cryptographically secure random source, using rejection sampling so no character is more likely than another. This tool never uses Math.random.

No. The whole tool runs in your browser. Passwords are created locally and are never uploaded, logged, or stored. Close the tab and they are gone.

Yes. Each password starts with at least one character from every set you turn on, then the rest are drawn from the whole pool and shuffled, so a site that requires a digit or a symbol will always accept it. The only exception is a length shorter than the number of sets, where there is no room for one of each.

It estimates entropy in bits as length multiplied by log2 of the character pool size. More bits means harder to guess. As a rough guide, under 40 bits is weak, 60 or more is strong, and 120 or more is very strong.

It removes look-alike characters that are easy to misread or mistype: capital I, lowercase l, the digit 1, capital O, and the digit 0. This is useful for passwords you will read aloud or copy by hand.

For most accounts, aim for at least 16 characters with a mix of character types. For high-value logins use 20 or more. Length matters more than complexity, so a longer password with fewer symbol types is still very strong.

Both can be strong. What matters is how many guesses an attacker would need. A random 16-character password drawn from all four character sets is far stronger than a short phrase, while five or more truly random words are easier to type and remember. Keep either in a password manager.

Current NIST guidance says not to force routine changes. Change a password when there is a sign it was exposed, such as a breach notice, and never reuse the same password on two sites.