Password Generator

How to use this tool

1. Set the length. Use the slider or number input to pick a length. 16–20 characters is a good default; longer is better for important accounts.
2. Pick character classes. Toggle uppercase, lowercase, digits, and symbols. Leave all four on for the strongest result.
3. Generate. Click Generate. The password appears below - click Copy to put it on your clipboard. Click Generate again for a new one.

How this generator works in your browser

Every password is built locally with the Web Crypto API. When you click Generate, your browser calls crypto.getRandomValues to draw raw entropy from the operating system, then maps those bytes to characters from the pool you selected. We use rejection sampling (discarding any byte that would land in an over-represented bucket), so the result is a true uniform sample. Plain modulo arithmetic introduces small but real bias against the highest-numbered characters in the pool, and we'd rather not ship that.

Nothing is transmitted. No analytics event fires when you generate. The page itself loads JavaScript from Toolcroft and ads from Google AdSense, but the password you see is computed inside your browser tab and lives only there. Open the Network tab in your browser's developer tools, click Generate, and watch: no request goes out.

What makes a strong password

Strength comes from two things: the size of the character pool you draw from and the length of the password. A common pool-based estimate is length × log2(pool size). For 12 lowercase-only characters, that is about 56 bits. With the default exclusions and all four classes enabled, the pool has about 82 characters: 12 characters estimate to about 76 bits, while 20 estimate to about 127 bits. Turning off ambiguous-character exclusion expands the pool to about 87 characters, or about 129 bits at length 20.

The strength bar under each generated password shows the bits-of-entropy estimate for the pool and length you picked. It treats each character as an independent uniform draw; the generator also guarantees at least one character from each enabled class, so the estimate does not exactly model its generated distribution. Anything in the green band is a useful pool-based guide; reserve the longest options for password-manager master passwords, encryption keys, and similar high-value secrets.

How to read the crack-time estimate

The result includes a mean brute-force search time at 10 billion guesses per second, an illustrative fast offline-hash rate. The estimate uses the pool-based entropy figure and assumes an attacker can test guesses at that rate. A properly salted, slow password hash can make each guess much more expensive, while online login systems may throttle attempts. The calculation does not cover phishing, password reuse, malware, or other ways an attacker can bypass brute force entirely.

How long should a password be?

For routine accounts protected by a sensible login system, 16 characters from a mixed pool is plenty. Bumping to 20 buys you significant headroom for very little typing cost, especially if you keep the password in a manager and rarely type it by hand. Master passwords for a password vault or whole-disk encryption deserve 24 or more. Those are single points of failure, and length is the cheapest defence available.

Some sites still cap password length at 16 or even 12. That's their problem, not yours. Generate to the cap and move on; the strength is set by the lower of the two numbers.

When the exclusion options matter

• Exclude ambiguous (I l 1 O 0) is worth keeping on if you'll ever read the password off a screen and type it on another device. The security cost at 16+ characters is negligible.
• Exclude similar (curly braces, pipe, double-quote, backtick) helps if you're pasting passwords into systems that mangle quoting, such as some shell scripts or YAML configs.
• Custom exclude covers the case where a particular site rejects a specific character. Type the offender(s) into the box and regenerate.

Password manager integration

Even the strongest generated password is useless if written on a sticky note or reused across sites. The recommended workflow is:

1. Generate a password in this tool.
2. Immediately copy and paste it into your password manager (Bitwarden, 1Password, Dashlane, KeePass, etc.) before navigating away.
3. Let the password manager auto-fill it going forward - never type it by hand.

A password manager also enables a unique password for every account with no memory burden - the single most impactful security improvement most people can make.

NIST 2017 password guidelines

NIST Special Publication 800-63B (2017, updated 2024) significantly revised official password guidance. Key recommendations that changed the industry:

• No mandatory complexity rules: requiring uppercase + lowercase + digit + symbol does not meaningfully improve security and leads users to predictable patterns (Password1!). Length is more important than composition.
• No periodic rotation without cause: forcing monthly or quarterly password changes causes users to make small, predictable modifications (Password1 -> Password2). Change passwords only when there is evidence of compromise.
• Screen against breached passwords: organizations should check new passwords against known breach databases (like HIBP) and reject matches, regardless of complexity.
• Allow all printable ASCII and Unicode: blocking spaces or special characters is a legacy restriction that reduces entropy unnecessarily.