Password Generator

About the Password Generator

A password that a person can remember is usually a password that a computer can guess. Names, dates, keyboard patterns, and tidy substitutions like swapping an a for an @ follow habits that attackers build into their guessing tools. A truly random password has no such habits. Every character is chosen independently from your selected character sets, so there is no pattern to exploit, and the only way in is to try combinations until one fits. This generator builds those passwords in your browser, with a length from 4 to 128 characters.

The randomness comes from the Web Crypto interface that browsers provide for security purposes, not from the ordinary Math.random function. It takes a random 32-bit number for each character and maps it onto your character pool. The pool is built from the boxes you check: 26 uppercase letters, 26 lowercase letters, 10 digits, and 26 symbols. With all four enabled the pool has 88 characters, and a 16-character password has about 1.3 times 10 to the 31st possible values. Symbols are off by default, so tick that box if the site allows them.

The tool is for anyone creating a new account, replacing a reused password, setting up a Wi-Fi network, or filling a password manager. It generates the password and nothing else. It does not store, send, or recall anything, so you must copy the result straight into a password manager or the sign-up form. It also does not check whether a website accepts your choices, because some sites limit length or reject particular symbols.

When to Use It

How to Use It, Step by Step

1. Set the Password length. The default is 16, and the field accepts values from 4 to 128. Longer is stronger, so use the maximum the site allows for important accounts.
2. Leave Include uppercase letters (A-Z) checked unless the site forbids capitals. Each enabled set widens the pool of characters the generator draws from.
3. Leave Include lowercase letters (a-z) checked in almost all cases, since lowercase letters make up the bulk of ordinary passwords and are accepted nearly everywhere.
4. Leave Include numbers (0-9) checked unless the site restricts digits. Numbers add ten characters to the pool and raise the strength rating requirement for variety.
5. Tick Include symbols (!@#$...) when the site accepts them. This box starts unticked, and adds 26 punctuation characters. If a site rejects some symbols, generate again with symbols off and a longer length.
6. Press the Generate Password button. The password and a strength label appear, and each press produces a different password.
7. Copy the password immediately into a password manager or the sign-up form. The tool does not save it, and pressing the button again replaces it.
8. Test the new password at the site, and keep the old one until you are sure the change worked, especially for email and banking accounts.

Understanding Your Results

The result has two parts: the password itself and a strength label of Weak, Moderate, or Strong. The label is a simple rule of thumb. Strong needs at least 12 characters and at least three of the four character types. Moderate needs at least 8 characters and at least two types. Anything else is Weak. It is a quick guide, not a precise measurement, and it does not examine the specific characters generated.

The more meaningful number is the size of the pool and the length. The number of possible passwords is the pool size raised to the power of the length, and the strength in bits is the length times the base-2 logarithm of the pool size. A 20-character password from the 88-character pool has about 129 bits, which is far beyond any realistic guessing attack. Each extra character multiplies the possibilities by the pool size.

Do not read too much into the label. Because the generator chooses characters independently, it does not guarantee that every selected type appears, so a short password may happen to contain no digit or symbol even when those are enabled. For that reason, favor length over cleverness. If a site requires a particular mix, check the result and press the button again if something is missing.

More Worked Examples

Tips for Better Results

• Store generated passwords in a reputable password manager and let it fill them in. Then each password can be long and random, and you only need to remember one strong master passphrase.
• Prefer length over complexity rules. A longer random password beats a short one with every character type, and current guidance from standards bodies favors length and breach screening over forced symbols.
• Turn on two-factor authentication for important accounts. Even a perfect password can be phished, and a second factor stops most account takeovers that rely on a stolen password.
• Use a different password for every account. When one site is breached, attackers try the leaked password everywhere else, so unique passwords keep a single leak from spreading.
• If a site limits length or characters, pick the longest value it accepts and drop any rejected symbol set. A 20-character letters-and-digits password is still excellent.
• Do not use the example passwords shown on this page or any website. They are samples, and a password that has been published is no longer secret.

Common Mistakes to Avoid

• Using the generated password in more than one place. Reuse defeats the purpose, because one breach exposes every account that shares it.
• Making the password short because it is hard to remember. A random password is not meant to be memorized, so use a password manager and keep the length high.
• Saving the password in a plain note, email draft, or spreadsheet. A strong password stored carelessly is only as safe as the place where it is kept.
• Assuming a Strong label means unbeatable. The label is a rule of thumb, and the real protection also depends on how the site stores passwords and whether you use two-factor authentication.
• Skipping the copy step. The tool does not keep the password, so if you press the button again or close the tab, the earlier one is gone and you cannot recover it.

Assumptions and Limits

• Characters are chosen independently and uniformly from the pool using the browser's secure random source. The tool does not force one of each selected type, so a given password may lack a type.
• The symbol set is fixed at 26 characters: ! @ # $ % ^ & * ( ) _ + - = [ ] { } | ; : , . < > ?. Some websites reject certain symbols, and the generator does not know which ones.
• Visually similar characters such as the letter l, the digit 1, the capital I, the letter O, and the digit 0 are all included. Passwords you must read aloud or retype by hand may need extra care.
• The strength label depends only on length and the number of character types, not on actual guessing resistance. Security depends on the website's storage practices, your device's safety, and whether you reuse or share the password.

Key Terms

Entropy

A measure of unpredictability, expressed in bits. Each additional bit doubles the number of guesses needed, so more entropy means a harder password to crack.

Brute-force attack

An attack that tries many possible passwords until one works. Long random passwords make this approach impractical because the number of combinations is huge.

Password manager

A program that stores your passwords in an encrypted vault and fills them in for you, so each account can have its own long random password.

Credential stuffing

An attack that takes leaked username and password pairs from one breach and tries them on other websites, which works when people reuse passwords.

Two-factor authentication

A sign-in method that needs a second proof beyond the password, such as a code from an app or a hardware key.

Character pool

The full set of characters the generator may choose from, determined by which boxes you tick. A larger pool means more combinations at the same length.