Password Generator

A strong password is one that's long, random, and drawn from a large pool of possible characters — this makes it resistant to both guessing attacks and automated brute-force attempts that try large numbers of combinations. This tool generates passwords using the Web Crypto API's cryptographically secure random number generator (crypto.getRandomValues), the same class of randomness used to generate encryption keys, rather than a simpler and more predictable random function. The entire process runs locally in your browser, so the password is never transmitted, logged, or visible to any server.

Use the length slider to choose how many characters your password should contain — longer passwords are generally stronger, and most current security guidance recommends at least 12 to 16 characters for everyday accounts. Then choose which character types to include: uppercase letters, lowercase letters, digits, and symbols. Including all four types maximizes the pool of possible characters at each position, which significantly increases the number of possible combinations an attacker would need to try. The "exclude ambiguous characters" option removes characters that are easy to misread or mistype, such as a lowercase l, uppercase I, the digit 1, uppercase O, and the digit 0 — useful when a password needs to be read aloud or typed manually rather than pasted.

As you adjust these settings, a new password is generated automatically, along with a strength rating (Weak, Fair, Strong, or Very strong) based on the total number of possible combinations given your chosen length and character types. Click "Regenerate" any time for a fresh password using the same settings, and "Copy" to copy the current password to your clipboard.

This tool is useful whenever you need a new password for an account, especially for services where you'll store the password in a password manager rather than needing to memorize it — which means there's no downside to making it as long and random as the service allows. Avoid reusing generated passwords across multiple accounts, and store them in a reputable password manager rather than writing them down in an unsecured location.