How to use the Password Generator
- 1 Set the length with the slider – 16 characters or more is recommended.
- 2 Choose which character sets to include and whether to exclude look-alike characters.
- 3 Click Generate and copy the password into your password manager.
What makes a password strong?
Strength comes from length and randomness. A password chosen by a computer from a large set of characters is far harder to guess than one a human invents, because people follow predictable patterns such as capital letter first and digits and an exclamation mark at the end.
Entropy explained
Entropy measures how unpredictable a password is, in bits. It is calculated as length × log₂(number of possible characters). Each extra bit doubles the number of guesses an attacker needs.
| Entropy | Rating | Example |
|---|---|---|
| < 50 bits | Weak | 8 lowercase letters |
| 50–70 bits | Fair | 10 mixed characters |
| 70–100 bits | Strong | 14 characters, all sets |
| ≥ 100 bits | Very strong | 16+ characters, all sets |
Generated safely
Passwords are created in your browser using the Web Crypto API, a cryptographically secure random number generator. Each selected character set is guaranteed to appear at least once, and characters are picked without bias. Nothing is sent to our servers or stored.
Best practices
- Use a different password for every account.
- Store passwords in a password manager instead of reusing or writing them down.
- Turn on two-factor authentication wherever possible.
- Exclude look-alike characters (I, l, 1, O, 0, o) if you need to type the password by hand.
Frequently asked questions
How long should my password be?
At least 12 characters, and 16 or more for important accounts such as email and banking. Longer is always better when a password manager remembers it for you.
Are the generated passwords stored?
No. They are generated on your device and disappear when you leave the page. We never see them.
Why exclude ambiguous characters?
Characters like l, 1 and I or O and 0 look alike in many fonts. Excluding them avoids typos when you have to read or type a password manually, at the cost of a little entropy.
Last updated: