Where is the password generated?

In this browser tab. It is produced by crypto.getRandomValues on your own device, is not sent to a server, and is not stored or logged anywhere.

Is the randomness good enough for a real password?

Yes. crypto.getRandomValues is the browser's cryptographic random source, not Math.random, and the sampling rejects values that would otherwise make some characters slightly more likely than others.

How long should my password be?

Long enough to clear roughly 80 bits of entropy, which with all four classes enabled is about 13 characters, and comfortably more if the site allows it. The bits figure on the page tells you where you stand.

Does it save or remember what it generated?

No. There is no history and nothing is written to storage, so once you navigate away or press Regenerate the previous value is gone. Copy it into a password manager before you leave the page.

Can it make a passphrase out of words?

No. This page only samples individual characters; it does not have a word list and cannot build a multi-word passphrase.

Which symbols can appear?

The punctuation set !@#$%^&*()-_=+[]{};:,.<>?/ when the symbol class is enabled. If a form rejects one of them, turn symbols off and add a couple of characters of length instead.

What does the entropy figure mean?

It is the base-2 logarithm of how many passwords your settings could produce, so each extra bit doubles the guessing work. It measures the settings, not whether you later reuse the password somewhere.

Password Generator

••••••••••••••••

Excellent · 102 bits of entropy

Length16

Passwords are generated locally with crypto.getRandomValues and never leave this browser.

How to generate a strong random password

Password Generator builds a random password from the character classes you enable, using the browser's cryptographic random number generator rather than the ordinary one used for shuffling or animation. You set the length between 4 and 64 characters, turn lowercase, uppercase, digits, and symbols on or off, and optionally drop the characters that are easy to misread. The page reports the resulting entropy in bits so the strength claim is a number you can check, not a colour.

Generate a password in four steps

Set the lengthDrag the length slider anywhere from 4 to 64 characters. Length is the cheapest way to add strength: every extra character multiplies the number of possibilities an attacker has to work through.
Choose the character classesToggle lowercase, uppercase, digits, and symbols. Each class you leave on is guaranteed to appear at least once in the result, so a site that demands one digit and one symbol will accept it.
Decide about ambiguous charactersExclude ambiguous is on by default and removes l, 1, I, O, and 0. Keep it on for a password you will read aloud or retype from a screen; turn it off to get a slightly larger character pool.
Check the entropy, then copyThe bar and the bits figure update with every change: below 50 bits is weak, 100 bits or more is excellent. Press Regenerate until you are happy with the result, then copy it and paste it straight into your password manager.

What people use Password Generator for

Create a unique password for one new accountGenerate it, paste it into your password manager as you sign up, and never reuse a password across sites again.
Rotate a credential after an incidentWhen a service reports a breach, generate a fresh value at the maximum length the service accepts rather than editing the old one.
Produce a service or database passwordGenerate a long alphanumeric value for a config file or secret store, with symbols turned off when the consuming system escapes them badly.
Meet an awkward password policyTurn on exactly the classes a form demands and set the length it allows, so the value is accepted on the first try.

Password Generator questions

Where is the password generated?: In this browser tab. It is produced by crypto.getRandomValues on your own device, is not sent to a server, and is not stored or logged anywhere.
Is the randomness good enough for a real password?: Yes. crypto.getRandomValues is the browser's cryptographic random source, not Math.random, and the sampling rejects values that would otherwise make some characters slightly more likely than others.
How long should my password be?: Long enough to clear roughly 80 bits of entropy, which with all four classes enabled is about 13 characters, and comfortably more if the site allows it. The bits figure on the page tells you where you stand.
Does it save or remember what it generated?: No. There is no history and nothing is written to storage, so once you navigate away or press Regenerate the previous value is gone. Copy it into a password manager before you leave the page.
Can it make a passphrase out of words?: No. This page only samples individual characters; it does not have a word list and cannot build a multi-word passphrase.
Which symbols can appear?: The punctuation set !@#$%^&*()-_=+[]{};:,.<>?/ when the symbol class is enabled. If a form rejects one of them, turn symbols off and add a couple of characters of length instead.
What does the entropy figure mean?: It is the base-2 logarithm of how many passwords your settings could produce, so each extra bit doubles the guessing work. It measures the settings, not whether you later reuse the password somewhere.