Free Password Generator — Create Strong Random Passwords in Your Browser

What Is a Random Password Generator?

A random password generator is a small utility that builds passwords from a pool of characters using a source of randomness, rather than leaving the choice to a human brain. That matters because people are predictably bad at randomness. We repeat patterns, lean on dictionary words, swap a letter for a predictable number, and reuse the same password across sites. A generator has no habits to fall back on, so the output is far harder for an attacker to guess or brute-force.

This particular generator runs entirely in your browser. Nothing is sent to a server, nothing is stored, and there is no signup step. The password you see on screen is created from your browser's built-in cryptographic random source the moment you open the page or change any setting.

Why Use This Generator

Human-chosen passwords tend to be short, memorable, and therefore weak. Even a long password built from a favourite phrase can be vulnerable if the phrase appears in a common wordlist. A generator gives you three practical advantages:

• Real randomness. The tool draws from crypto.getRandomValues, which is the browser-standard source of cryptographic randomness. It avoids the predictable patterns that creep into hand-picked passwords.
• Tunable complexity. You decide the length and which character sets to include. Need a short password for a low-risk forum? Dial it down. Need a robust password for an email or banking account? Crank the length up and include everything.
• Instant feedback. The tool shows a strength rating and an entropy figure in bits so you can see, in concrete terms, how much search space an attacker would need to cover. You do not have to guess whether a password is "good enough".

It is also handy when you are provisioning a new account and want a password that will not collide with one you already use. Copy it once, paste it into the signup form, and let a password manager remember it for you.

How to Use the Tool

The widget is built around a generated password, a strength rating, an entropy readout, two action buttons, a length control, and a set of character options. Here is the flow.

Step 1 — Read the generated password. The Generated password field shows the current password in bold text. It is not an editable input; it is a display only. You can select the text with your mouse or keyboard if you want to copy it manually.

Step 2 — Check the strength rating. The Strength rating field reads Very Weak, Weak, Good, Strong, or Very Strong. The rating is derived from the password's entropy, so it updates whenever the length or character options change. The text label is always present; colour is a secondary cue only.

Step 3 — Read the entropy. The Entropy field shows a number such as 48.7 bits. Entropy measures how many bits of randomness are in the password. Higher is better. The value is rounded to one decimal place and always includes the word bits.

Step 4 — Copy or regenerate. Use Copy to clipboard to put the password on your clipboard. A brief Copied note appears for about a second and then disappears; no alert box is used. Use Generate new to replace the current password with a fresh one drawn from the same settings.

Step 5 — Set the character length. The Character length group has a number input and a slider. The number input is disabled and reflects the current length. The slider does the controlling: drag it between 4 and 64. The password regenerates automatically when the length changes.

Step 6 — Choose character sets. The checkboxes below the length control the character pool:

• Lowercase letters (a–z) — adds abcdefghijklmnopqrstuvwxyz.
• Uppercase letters (A–Z) — adds ABCDEFGHIJKLMNOPQRSTUVWXYZ.
• Digits (0–9) — adds 0123456789.
• Special characters — adds printable ASCII punctuation such as !"#$%&'()*+,-./:;<=>?@[\]^_\{|}~`.
• Omit look-alike characters — removes characters that are easy to confuse when reading or typing, such as i, I, l, 1, L, |, o, O, 0, backtick, apostrophe, dash, underscore, colon, semicolon, period, and comma.
• Omit bracket characters — removes <, >, (, ), [, ], {, }.
• Unique characters only — forces every character in the password to be different. This increases entropy per character but caps the maximum usable length to the size of the pool.

At least one character set is always active. If you uncheck every set, the last one you touched stays on so the pool never becomes empty.

Step 7 — Work from the defaults or customise. On first load the tool uses length 16, with lowercase, uppercase, digits, and special characters enabled, and the three omit/unique options off. That is already a strong starting point for most accounts. Adjust from there.

Worked Examples

Entropy for a password with no uniqueness constraint is length × log2(poolSize), rounded to one decimal. When Unique characters only is on, the entropy uses the permutation formula instead, because the pool shrinks after each character is drawn.

Example 1 — Compact but filtered. Length 8, all four character sets on, omit look-alikes on, omit brackets on.

• The full pool with all four sets is 94 characters.
• Removing the 18 look-alike characters and the 8 bracket characters leaves 68.
• 8 × log2(68) ≈ 48.7 bits.
• That lands in the Good band.

Example 2 — Longer and unfiltered. Length 16, all four sets on, no omits.

• Pool size is 94.
• 16 × log2(94) ≈ 103.8 bits.
• That is in the Very Strong band.

Example 3 — Short digit-only pin. Length 6, digits only.

• Pool size is 10.
• 6 × log2(10) ≈ 19.9 bits.
• That is Very Weak. Fine for a screen lock you type often, not for an account that protects sensitive data.

Example 4 — Unique characters, long password. Length 20, all four sets on, no omits, unique characters on.

• Pool size is 94, length 20 is less than 94, so generation proceeds.
• Entropy is sum(log2(94 - i)) for i from 0 to 19, which is higher per character than the simple formula because later draws have fewer choices. The tool computes this automatically.

If you turn on Unique characters only and set a length greater than the pool size, the tool shows a short message: Length cannot exceed the character pool when unique characters are required. It does not generate a partial password or crash.

Tips and Best Practices

• Length beats cleverness. A long password drawn from a modest pool is usually stronger than a short password with many symbol types. If you can type it comfortably, push the length up first before adding complexity you will not remember.
• Use a password manager. Generators are most useful when paired with a manager that stores the result for you. That way you can use a different strong password on every site without having to memorise any of them.
• Do not reuse passwords. A strong password loses much of its value if it appears on five different services. If one of those services is breached, attackers try the captured password on other popular sites.
• Reserve the omit options for manual entry. If you are pasting a password into a login form, look-alike and bracket filtering is less important. If someone will type the password by hand on a device with a small keyboard — a Wi-Fi password on a phone, for example — omitting look-alikes reduces typos.
• Mind the unique-characters cap. When Unique characters only is on, the maximum length is bounded by the pool size. With all sets on and no omits, that ceiling is 94. Plan your length accordingly.
• Treat entropy as a guide, not a guarantee. Entropy measures the size of the search space assuming the attacker knows your method but not your result. It does not account for server-side rate limiting, breached password databases, or phishing. A high-entropy password is still a good password, but it is one layer, not the whole defence.
• Regenerate if a password feels exposed. If you accidentally pasted a password into the wrong field or suspect it was visible on a shared screen, hit Generate new and update the account.

Frequently Asked Questions

Is the password sent to a server? No. The password is generated in your browser using crypto.getRandomValues. It never leaves your device. Nothing is uploaded, stored in localStorage, saved to a cookie, or appended to a URL.

What is entropy? Entropy is a measure of how many bits of randomness a password contains. You can think of it as the size of the search space an attacker would need to cover if they had to brute-force the password character by character. A password with 48.7 bits of entropy has roughly 2^48.7 possible equivalents. The higher the number, the harder the brute-force job.

How is the strength rating decided? The rating is read from the entropy value. Below 28 bits is Very Weak, 28 to 35.9 is Weak, 36 to 59.9 is Good, 60 to 127.9 is Strong, and 128 or more is Very Strong. The colour on screen is a visual hint; the text label is the real signal.

Why does the tool use crypto.getRandomValues instead of Math.random()? Math.random() is not designed to be unpredictable. It is fine for a game or a sketch, but not for a secret that an attacker might try to reproduce. crypto.getRandomValues is the browser's standard source of cryptographic randomness and is the right tool for password generation.

What happens if I set a length greater than the pool with unique characters on? The tool shows a short message instead of a password: Length cannot exceed the character pool when unique characters are required. Lower the length or turn off the unique-characters option to continue.

Can I use this for a Wi-Fi password? Yes. If the password will be typed by hand on multiple devices, consider turning on Omit look-alike characters so people do not confuse l with 1 or O with 0. A length around 15 to 20 with several character sets on is a reasonable balance between security and manual usability.

Related Tools

More generator tools are on the way. In the meantime, explore the rest of the free utilities in the Tools section — all built to run privately in your browser.