How long should a password be?

For random characters, 12 is a practical minimum and 16+ is comfortable against modern offline cracking. Length beats symbol variety: a 20-character alphanumeric password is far stronger than a short one with every symbol type.

Is this generator safe to use for real credentials?

Yes. It draws from crypto.getRandomValues() — the browser’s cryptographic random source — and everything happens locally. Nothing is transmitted or logged.

Random string or passphrase?

Both are valid. A passphrase of four or more unrelated words is easier to memorize and type on mobile; random strings are best when a password manager stores them. Avoid leetspeak transformations of dictionary words — cracking dictionaries try those first.

Generators

Password Generator

Generate secure random passwords with custom length and character sets.

Generated password

Strength:

Click generate to create a password

Password options

What is a Password Generator?

A password generator creates strong, random passwords based on customizable criteria. Using randomly generated passwords significantly improves account security compared to human-chosen passwords.

Password Options

Length: Recommended minimum 12 characters
Uppercase: A-Z letters
Lowercase: a-z letters
Numbers: 0-9 digits
Symbols: Special characters like !@#$%
Exclude Similar: Avoid confusing characters (i, l, 1, O, 0)

Strength Levels

Weak: Meets few requirements, low security
Medium: Meets some requirements, moderate security
Strong: Meets most requirements, high security
Very Strong: Meets all requirements, maximum security

Security Tips

Use at least 12 characters
Mix uppercase, lowercase, numbers, and symbols
Avoid personal information or common patterns
Use different passwords for different accounts
Consider using a password manager

A password generator builds a string from a chosen alphabet of up to 88 characters and draws every position independently, so the result carries about 6.46 bits of entropy per character. Use it when a signup form needs an initial credential, or when you must state a password composition precisely.

The pool is 88 characters, but only 12 can be excluded

Ticking all four boxes concatenates 26 uppercase, 26 lowercase, 10 digits and 26 symbols — !@#$%^&*()_+-=[]{}|;:,.<>? — for a pool of 88. Quotes, backslash, forward slash, tilde and backtick are deliberately absent because they break shell commands, SQL literals and CSV columns. That absence changes what the second toggle does: "exclude ambiguous" lists 18 characters, yet only ()[]{};:,.<> are in the pool, so it leaves 76 characters rather than 70. Adding "exclude similar" strips the seven characters i l 1 L o 0 O and brings the alphabet down to 69.

Cryptographic draws, a modulo remainder, and no class guarantee

Each roll allocates a Uint32Array of the chosen length, fills it with crypto.getRandomValues(), then maps each 32-bit value through value % 88. Because 2 to the 32nd is not a multiple of 88, the remainder of 48 means 48 characters receive 48,806,447 of the possible values and the other 40 receive 48,806,446, a relative bias near 2e-8 that is irrelevant next to every other assumption here. What matters far more is independence: enabled classes are never enforced. With digits ticked, a 16-character roll has (78/88)^16, about 14.5%, chance of containing no digit at all — one draw in seven that a "must include a number" form will reject.

What the strength bar scores, and what it cannot see

The bar is a seven-point rubric evaluated on the finished string, not on your settings. Length earns one point each at 8, 12 and 16 characters; lowercase, uppercase, digit and non-alphanumeric each earn one point when they actually appear. Scores of 2 or less read weak, 4 or less medium, 6 or less strong, and only 7 reads very strong. Two consequences follow. A 16-character alphanumeric result that happens to miss the symbols scores 6 and shows strong, and Password123! also scores 6 — a breached classic and a fresh random draw wear the same label. Treat the bar as a shape check and read strength from entropy instead: 16 characters over 88 symbols is 16 × log2(88) ≈ 103.3 bits.

Worked example

Cost of the two exclusion toggles

Input

length 16 · A-Z + a-z + 0-9 + symbols · exclude similar on · exclude ambiguous on

Output

pool 69 · 69^16 = 263,988,769,565,513,973,843,201,106,881 ≈ 2.64 × 10^29 · 16 × log2(69) ≈ 97.7 bits

88 minus 7 similar minus 12 ambiguous leaves 69 characters, not 88 minus 18, because six of the listed punctuation marks never enter the pool. Both toggles cost 5.6 bits, while moving from 12 to 16 characters at full width adds 25.8 bits.

Limits and pitfalls

The length slider stops at 4 and 64: four characters from the whole pool is 25.8 bits, and 64 characters is 413.4 bits, with nothing in between changing the pool itself.
A ticked class is not a present class. Roughly one in seven 16-character rolls made with digits enabled contains no digit, and forms demanding a number will refuse it.
The symbol pool is fixed at 26 characters, so single quote, double quote, backslash, forward slash, tilde and backtick can never be produced; a form requiring one needs another source.
The strength bar reads length thresholds and class presence only, so Password123! is labelled strong at 6 of 7 points.
Changing the slider or a checkbox regenerates at once and the previous value is gone; there is no history, so copy the string before adjusting anything.

Related tools

When a random draw is the wrong instrument

Decision	This generator	Alternative
A validator rejects the string unless every class is present	Nothing is enforced: every position comes from the same pool, so digits ticked at 12 characters still leaves 23.5% of rolls with no digit at all, (78/88)^12, while the symbol rule trips only 1.5% of 12-character rolls — the digit row is the one that bounces.	A short Python routine: draw one character per required class with `secrets.choice`, fill the remainder from the 88, shuffle with `random.SystemRandom()`. It always passes, but the result is no longer one clean independent draw.
The value ends up in a shell command, a SQL literal or a docker-compose `.env`	Quotes, backslash, slash, tilde and backtick were left out on purpose, but sixteen of the 26 symbols are shell metacharacters, so only 4% of 16-character rolls avoid all of them, and `$` is still interpolated by Compose.	`secrets.token_urlsafe(16)`: 22 characters over a 64-symbol alphabet, nothing to quote in bash, psql or a `.env` line.
It has to be said over the phone or typed from memory	Sixteen characters at 103.4 bits are noise by construction, with no word, rhythm or structure to lean on, and the page keeps no record once you navigate away.	Diceware against the 7776-word EFF list: 6 words is about 77.5 bits, 8 words about 103.4 bits — the default strength in a form a person can actually hold.
Two machines must end up with the same password and there is no vault	Impossible to repeat: `crypto.getRandomValues()` is called with no seed and no input, so the same settings produce an unrelated string on every click.	Derive instead: `HMAC-SHA256(master, "host.example")` yields 32 bytes, and the first 20 hex digits of it are 80 bits per site; the HMAC tool computes exactly this in the browser.
A provisioning script needs 500 throwaway passwords	One string at a time, held in a single ref that the next click, slider move or checkbox overwrites; no batch mode and no export.	`for i in $(seq 500); do openssl rand -base64 18; done > secrets.txt` writes 500 lines of 24 characters, 144 bits each, straight to a file.
The consumer demands more than 64 characters	The slider stops at 64, so a 128-character API key means generating twice and splicing the halves — and the first half is gone as soon as the second roll replaces it.	`openssl rand -base64 96`: 96 bytes is 768 bits spelled as 128 Base64 characters in one pass.

One concrete scenario

A 20-character staging password that has to survive a form and a .env file

The staging Postgres password for a new environment is boxed in three ways: the policy service demands at least one digit and one symbol, the old admin panel truncates anything past 20 characters, and the same string goes into a docker-compose .env. Set the slider to 20 with all four classes ticked: the pool is 88, so the roll carries 20 × log2(88) ≈ 129.2 bits. Two misses are still possible — 9.0% of rolls contain no digit, (78/88)^20, and 0.09% contain no symbol — each rarer than at the 16 default, where the digit figure is 14.5%. Keep 20, leave both exclusion boxes unticked, and write every $ as $$ before pasting into .env.

Frequently Asked Questions

How long should a password be?: For random characters, 12 is a practical minimum and 16+ is comfortable against modern offline cracking. Length beats symbol variety: a 20-character alphanumeric password is far stronger than a short one with every symbol type.
Is this generator safe to use for real credentials?: Yes. It draws from crypto.getRandomValues() — the browser’s cryptographic random source — and everything happens locally. Nothing is transmitted or logged.
Random string or passphrase?: Both are valid. A passphrase of four or more unrelated words is easier to memorize and type on mobile; random strings are best when a password manager stores them. Avoid leetspeak transformations of dictionary words — cracking dictionaries try those first.

Content reviewed: 2026-10-22