Generate a Strong Random Password
This free password generator creates random passwords from 6 to 64 characters long, using any mix of lowercase letters, uppercase letters, numbers and symbols. Every character is picked by your browser’s cryptographically secure random number generator, so the result has no pattern a person or a cracking tool could predict.
Nothing leaves your device: passwords are generated, displayed and copied locally, and they are not sent, saved or logged. Already have a password and want to know how it holds up? Test it with the password strength checker, which estimates its entropy.
How to Use the Password Generator
- 1
Set the length
Drag the Password Length slider anywhere from 6 to 64 characters. It starts at 16, which is a sensible default for most accounts.
- 2
Choose the character types
Tick or untick Lowercase (a-z), Uppercase (A-Z), Numbers (0-9) and Symbols. All four are on by default; at least one must stay ticked.
- 3
Pick how many passwords
Leave the Generate multiple passwords slider at 1 for a single password with a strength rating, or raise it to create up to 10 at once, one per line.
- 4
Generate and copy
Click Generate Password, then Copy to put the result on your clipboard and paste it into the sign-up form or your password manager.
There is no account to create and no limit on how many passwords you generate.
How Random Are the Passwords?
Many quick generators rely on Math.random(), which is fast but not designed for secrets: its output can be predictable. This tool uses crypto.getRandomValues, the same class of random source browsers use for encryption keys, and the one behind the UUID generator on this site.
Turning a random byte into a character has a subtle trap. A byte has 256 possible values, and 256 does not divide evenly by an 88-character pool, so a simple remainder would make the first 80 characters slightly more likely than the rest. The generator avoids that bias with rejection sampling: bytes from 176 to 255 are thrown away and redrawn, leaving 176 values that map evenly onto the pool, so every character has exactly the same chance of appearing.
Password Entropy Explained
Entropy measures how many guesses an attacker would need, in bits: entropy = length × log2(pool size). Each extra bit doubles the work, which is why adding length helps far more than swapping letters for look-alike symbols.
| Character types | Pool size | 12 characters | 16 characters |
|---|---|---|---|
| Lowercase only | 26 | 56.4 bits | 75.2 bits |
| Lowercase + digits | 36 | 62.0 bits | 82.7 bits |
| Letters + digits | 62 | 71.5 bits | 95.3 bits |
| All four types | 88 | 77.5 bits | 103.4 bits |
To put those numbers in context, assume an offline attacker testing 10 billion guesses per second against a fast, unsalted hash. A 6-character password using all four types (38.8 bits) would fall in about 24 seconds on average. A 12-character lowercase password (56.4 bits) would take around 55 days. A 12-character password with all four types (77.5 bits) would take roughly 340,000 years, and a 16-character one (103.4 bits) is out of reach of any realistic hardware.
Those figures get far better when a site stores passwords with a deliberately slow algorithm. You can see the difference yourself by hashing the same text with the SHA-256 hash tool, which is built to be fast, and the bcrypt generator, which is built to be slow and salted. If you come across a leaked hash and are not sure which algorithm produced it, the hash identifier can suggest the likely candidates.
Random Passwords vs Passphrases
A random character string packs the most entropy into the fewest characters, which makes it ideal for anything a password manager fills in for you. For the one or two secrets you must type from memory, such as the master password for that manager, a passphrase of five or six unrelated words is easier to remember. The random word generator is handy for brainstorming word lists; for a passphrase that protects something important, pick words with a true random method such as dice rather than by hand.
A generated string also works well as a shared secret for signing API requests. Once you have one, the HMAC generator lets you test signatures with it before wiring it into your code.
Common uses
- Creating a unique password when you sign up for a new account
- Replacing a weak or reused password after a data breach notice
- Generating several passwords at once when setting up service or test accounts
- Creating a long random string for a Wi-Fi network, database user or password vault entry
- Meeting a site’s rules by turning off symbols it does not accept
For more hashing, encoding and token utilities, browse all security tools.
Password security terms explained
| Term | What it means here |
|---|---|
| Character pool | The set of characters a password is drawn from; 88 here with all four types ticked, 62 with letters and digits only |
| Entropy (bits) | A measure of unpredictability: length multiplied by log2 of the pool size. Each extra bit doubles the number of guesses needed |
| CSPRNG | A cryptographically secure random number generator; in browsers this is crypto.getRandomValues, which this tool uses |
| Brute force | Trying every possible combination until one matches; random passwords can only be attacked this way |
| Dictionary attack | Guessing common words, names and leaked passwords with predictable tweaks; it fails against randomly generated strings |
| Password hash | The one-way fingerprint a well-built site stores instead of your password, ideally with a slow algorithm such as bcrypt |
Frequently Asked Questions
Yes. Every character is chosen with crypto.getRandomValues, the browser’s cryptographically secure random number generator, not Math.random. Out-of-range random bytes are discarded and redrawn, so each character in the pool is equally likely and there is no bias toward particular letters.
No. Passwords are generated entirely in your browser and are never transmitted, stored or logged. The only copy is the one on your screen until you copy it, and it disappears when you close or reload the page.
Use at least 12 characters and preferably 16 or more. With all four character types a 16-character password has about 103 bits of entropy, far beyond brute-force reach. The slider goes up to 64 characters for vaults and service accounts that accept long secrets.
Entropy is length × log2(pool size). With all four types the pool is 88 characters (26 lowercase, 26 uppercase, 10 digits and 26 symbols), about 6.46 bits per character: 12 characters give about 77.5 bits, 16 give about 103 bits and 20 give about 129 bits.
With Symbols ticked, the 26 symbols !@#$%^&*()_+-=[]{}|;:,.<>? are added to the pool. If a site rejects some of them, untick Symbols and add a few characters of length to make up the difference.
Not necessarily. Each character is drawn independently from the combined pool, so a short password can occasionally miss a type, such as having no digit. If a site insists on one of each, generate again or use a longer length, where missing a type becomes very unlikely.
There is no separate option to exclude ambiguous characters. The output uses a monospace font with extra letter spacing to make characters easier to tell apart, and copying the password instead of retyping it avoids the problem entirely.
It gives one point each for reaching 12 characters, reaching 16 characters, and containing lowercase, uppercase, digits and symbols. Two points or fewer is Weak, three or four is Medium, and five or six is Strong. It appears only when you generate a single password.
Yes. Set the Generate multiple passwords slider to any number from 1 to 10 and each password appears on its own line. The Copy button copies the whole list, and the strength meter is hidden for batches.
Yes, and make the password slightly longer instead. Letters and digits give a 62-character pool at about 5.95 bits per character, so a 20-character password without symbols has about 119 bits, more than a 16-character password with them.
No. Use a different password for every account and keep them in a password manager. If one site is breached, a unique password means the leak cannot be replayed against your other accounts.
Reviewed by Raja Jahangir · Last reviewed: October 2026
What makes a strong password?
A strong password is long before it is complex: length adds far more resistance to guessing than symbol substitutions do. Aim for at least 16 characters, unique to each account, generated randomly rather than chosen. Passwords generated here are produced in your browser and never transmitted.
Runs in your browser. Your files and text never leave your device - nothing is uploaded.