Skip to content
ToolBoxGenie

Password Generator

Developer Tools · Added 12 August 2026

Generate a password that no person and no ordinary random number generator would produce, with the character rules the site in front of you is demanding. Every password is drawn from your browser's cryptographic random number generator, in this tab, and is never transmitted or written to storage.

20

Length does more for strength than any character set. Sixteen is a sensible floor for anything that matters; the slider goes to 64, and the generator itself accepts up to 128.

Character sets

How to use the password generator

  1. 1Set the length. This does more for strength than anything else on the panel.
  2. 2Choose which character sets to include — some sites reject symbols, and this is where you work around that.
  3. 3Turn on 'exclude look-alike characters' if the password will be read off a screen or dictated to someone.
  4. 4Press Generate for a new one, or pick from the alternatives underneath.
  5. 5Copy it straight into your password manager. Reloading this page loses it, which is deliberate.

Examples

An everyday account password

Input
20 characters, all four sets
Result
About 131 bits of entropy — far beyond offline brute force

This is the default, and it is comfortably more than any consumer account needs.

A password you have to read aloud

Input
24 characters, no symbols, look-alikes excluded
Result
About 137 bits, with no O/0 or I/l confusion

Longer compensates for the smaller alphabet — length is the cheaper lever.

A site with a hostile length limit

Input
12 characters, all four sets
Result
About 78 bits — strong, though the limit is doing you no favours

A maximum length on a password field usually means it is being stored in a way that should worry you.

About the password generator

Length beats complexity, and it is not close

Adding a character set multiplies the pool once. Adding characters multiplies the whole search space again for every one you add. Going from 8 characters to 16 with lowercase letters alone is a far bigger jump than going from 8 lowercase to 8 across all four sets — roughly 38 bits of extra entropy against 15.

This is why the old advice to bolt an exclamation mark and a digit onto a short word has aged so badly. It satisfies a validation rule, adds barely any real unpredictability, and produces passwords that crackers now try first precisely because so many people were told to make them.

Where a generated password actually fails

A 20-character random string is not going to be guessed. What defeats it is reuse — one breached site handing an attacker a credential that works elsewhere — and phishing, where the strength of the password is irrelevant because you typed it into the attacker's form yourself.

That is the case for a password manager rather than a memorable scheme: it makes every password unique without you having to hold any of them, and it will not autofill a login form on a domain that merely looks right. Pair that with a second factor on anything that offers one, and the password itself stops being the weak link.

Frequently asked questions

Is this random enough to trust?
It uses crypto.getRandomValues, the browser's cryptographically secure random number generator, seeded by the operating system. It is not Math.random(), which is fast, predictable from its own output, and unfit for anything anyone logs in with. The character selection also uses rejection sampling rather than a modulo, so no character is even slightly more likely than another.
Is the password sent anywhere or saved?
Neither. It is generated in this browser tab, held in the page's memory, and gone when you close or reload. There is no upload endpoint on this site and nothing is written to local storage. That is also why there is no history: saved passwords would mean stored passwords.
What does the entropy figure mean?
It is length multiplied by the base-2 logarithm of the pool size — the number of bits of genuine unpredictability in the generation process. It assumes the attacker knows exactly which settings you used, which is the honest assumption. Sixty bits falls to a determined offline attack; eighty does not, on any hardware that exists.
Are random characters better than a passphrase?
Per character, yes; per unit of human effort, often not. Four or five genuinely random words carry plenty of entropy and are far easier to type on a phone or remember for the handful of passwords you cannot store. The strongest practical setup is a memorable passphrase for the password manager itself, and generated strings like these for everything inside it.

Related tools