Password Generator

The tool builds a pool from the character types you tick, then picks each character of the password from that pool using your browser's cryptographically secure random number generator (crypto.getRandomValues) — the same source browsers use for encryption. The password is created on your device and never sent anywhere.

The strength line is a calculation, not a test: entropy in bits = length × log₂(size of the pool). With all four sets ticked the pool has 87 characters, so each character adds about 6.4 bits. The label follows the total: under 40 bits is Weak, 40–59 Fair, 60–79 Strong, and 80 or more Very strong.

A new password is created when the page opens, every time you move the length slider, every time you change a checkbox, and when you click Regenerate.

1. Drag the Length slider to the length you need (the default is 16).
2. Tick the character types to include. Untick any the website does not allow.
3. Click Copy to copy the password, or Regenerate if you want a different one.
4. Paste it into the sign-up form and save it in a password manager.

• Use a different password for every account, and keep them in a password manager rather than trying to remember them.
• Longer beats more complicated. A 20-character password with letters and numbers only is stronger than a 10-character one with symbols. Use the largest length the site allows.
• If a site rejects certain symbols, untick Symbols (and make up the strength by lengthening the password) rather than editing the password by hand.
• If a password has to be typed by hand, for example on a TV, use a shorter length with Symbols off and make it longer to compensate.
• Copy the password before you leave or refresh the page — it is not saved anywhere and cannot be recovered afterwards.

• At least one character type must stay ticked; trying to untick the last one does nothing.
• The tool does not guarantee that every ticked type appears in a particular password. A short password with Numbers ticked could, by chance, contain no digits. If a site insists on one of each, click Regenerate until it does, or lengthen the password.
• It generates random characters only — there are no passphrases, no pronounceable passwords, and no option to avoid look-alike characters such as O and 0.
• The strength figure assumes an attacker knows only the length and character types. It does not check whether the password has appeared in a data breach.

Nothing. The password is created on the page and disappears on refresh — it is never stored or sent.