Overview
Think of a password as a combination lock. Every character you add is another dial, and every type of character you allow makes each dial bigger. A twelve-character password drawn from eighty possible symbols has more combinations than there are grains of sand on every beach on Earth. This tool builds exactly that kind of lock, then hands you the only key — once. There is no copy kept, no history, no 'recently generated' list.
You are not locked out of the process, though. The slider sets the length, the checkboxes choose which character families may appear, and a filter can strip out the look-alikes that cause trouble when passwords get read aloud or typed from paper. The entropy figure updates live, so instead of guessing whether a change helped, you watch the number move.
What counts as a random password?
A password in which each character was chosen independently of the others, from a known pool, by a source with no pattern. That independence is the entire security story. 'Sunshine2024!' fails not because it is short but because its parts relate to each other in ways guessing software already knows: a dictionary word, a year, a symbol at the end. A generator breaks every one of those relationships.
The score on this page — entropy, measured in bits — is the honest way to compare passwords. It is just length multiplied by the logarithm of the pool size. Under 40 bits falls fast, 40 to 60 is fair for throwaway accounts, 60 to 80 is strong, and past 80 you are in very-strong territory for ordinary life. Notice what moves the number fastest: length. Four extra characters beat a fancier symbol set almost every time.
Features
- Length from 4 to 128 characters, set with a slider or an exact number — the two always agree.
- Four character families — uppercase, lowercase, digits and symbols — each toggled independently.
- Look-alike filter that removes 0, O, 1, l, I and the pipe character for passwords typed by hand.
- Guaranteed coverage: every family you switch on appears at least once, placed at a random position.
- Live entropy meter with a plain strength label that reacts to every change you make.
- One-click copy with a confirmation, plus an instant 'new password' button — no form to submit.
- Cryptographic randomness from your browser's secure generator, drawn evenly with no bias.
Benefits
- Nothing to steal. The password exists only on your screen until you copy it — no server, no log, no leak.
- No account, no limits. Generate one password or a hundred, for yourself or a whole team.
- You learn the maths. Watching entropy move teaches you to judge passwords by length, not decoration.
- Works offline. Once the page is open, the internet can drop and generation continues.
Who can use it
Anyone creating an account, replacing a password caught in a breach, or finally retiring the old favourite reused across a dozen sites. It is equally useful for people who hand out credentials: developers seeding test accounts, admins issuing temporary logins, support staff resetting access. If a secret needs to exist and nobody should be able to guess it, start here.
How to use
- Set the length first — sixteen is a solid everyday default; go twenty-plus for email, banking and your password manager.
- Tick the character sets you want. If a site bans symbols, switch them off and add length instead.
- Turn on the look-alike filter if the password might ever be typed manually or read over the phone.
- Glance at the strength label, then press Copy password and paste it straight into the account or manager.
- Want a different one? Hit New password — each draw is fresh and independent.
Frequently asked questions
How long should my password actually be?
Sixteen random characters from letters and digits is comfortably strong for a normal account. For email, banking, or a password manager's master password, go to twenty or more — those accounts can reset everything else you own, so they deserve the extra dials on the lock.
Do symbols really make a password stronger?
They widen the pool, which helps, but length helps more for the same effort. A twenty-character password of plain letters and digits beats a twelve-character one full of symbols. Take the symbols when a site allows them, but never shorten the password to fit them in.
What is the entropy number telling me?
It is the size of the search space, in bits. Each bit doubles the guesses an attacker needs. Roughly: under 40 bits is weak, 40–60 is fair, 60–80 is strong, and over 80 is very strong for everyday use. It is arithmetic, not marketing.
Is it safe to generate a password on a web page?
On this one, yes — because the page does no networking at all for the tool. The characters come from your browser's built-in secure random source and the finished password lives only in the page's memory. Reload and it is gone. You can prove it: load the page, disconnect from the internet, and generate away.
Why would I exclude look-alike characters?
Because 0 and O, 1 and l, I and the pipe sign are genuinely hard to tell apart on paper, a blurry screen or a phone call. Removing them shrinks the pool slightly but hugely improves the odds of typing the password right the first time — worth it for anything entered by hand.
Can I reuse one generated password in several places?
Please don't. Reuse turns one breached site into a master key, because attackers automatically try leaked credentials everywhere. A fresh password per account, kept in a manager, is the habit that actually holds up.
Conclusion
A good password is long, random and used exactly once. This tool delivers the first two in seconds; the third is up to you. Pick a generous length, copy the result into a manager, and never think about that account's password again.