WebAssetKit

Text & developer

Secure Random Password Generator

Choose a length and the kinds of characters to include, and get a random password made by your browser’s secure random number generator. The password is not stored, logged or sent over the internet. A strength estimate in bits is shown for each setting.

Loading tool…

Strength
–
Entropy
–
Possible characters
–

Generated in your browser with crypto.getRandomValues. Nothing is stored or sent. Copy a password before you leave this page.

Options

Include



How to use the Password Generator

  1. Choose the length. Longer is stronger. 16 or more is a good start for important accounts.
  2. Tick the character types you want, and untick any your site does not allow.
  3. Click “Generate”, then copy the password. Make several at once if you need them.
  4. Save it in a password manager straight away. Do not reuse it on another site.

Tips for better results

  • Length matters more than symbols. A 20-character password of letters and digits is stronger than a 10-character one with symbols.
  • Use a different password for every account, and store them in a reputable password manager so you only remember one strong passphrase.
  • Where it is offered, turn on two-factor authentication as well. A strong password cannot protect you if the site itself is breached and you reused it.

Limitations you should know about

  • The strength figure is the entropy of a truly random choice from your settings. It does not know whether a site limits attempts, how it stores passwords, or whether a password has leaked elsewhere.
  • “Avoid look-alike characters” removes I, l, 1, O and 0, which slightly lowers the strength per character.
  • Some sites reject certain symbols or have a maximum length. Untick symbols or shorten the length if a site refuses the result.
  • This is a random-character generator. It does not make memorable word-based passphrases.

Frequently asked questions

Is it safe to generate passwords in a web page?

This page makes the password inside your browser with the browser’s cryptographic random generator (crypto.getRandomValues) and does not send it anywhere. You can check this with your browser’s network tools. As with any online tool, avoid using a computer you do not trust.

How long should a password be?

For important accounts, 16 characters or more of random letters, digits and symbols. Length is the main driver of strength.

Does the site remember my passwords?

No. Nothing is stored or logged. When you close or reload the page, the passwords are gone, so copy the one you want first.

What do the bits of entropy mean?

Each bit doubles the number of guesses needed. 60 bits is a reasonable minimum for online accounts, 80 bits or more is very strong against offline guessing. It is an estimate for random passwords only.

Guides that use this tool

Related tools