Overview
Ask ten people how they invent passwords and you will hear the same tricks: a pet's name plus a birth year, a favourite team with an exclamation mark, a keyboard zigzag. Attackers have read this playbook too — their software tries those patterns first, which is why human-invented secrets keep failing. This generator takes the human out of the equation entirely, assembling each password from your browser's cryptographic random source so there is no habit, theme or memory for anyone to exploit.
You still make the decisions that matter. Drag the length slider anywhere from 4 to 128 characters, switch the four character families on or off, and strip out look-alike characters if the password might be typed by hand. The entropy meter reacts to every change, translating your choices into a single honest number — so instead of guessing whether a password is strong, you can see it.
Why random beats memorable
A random password is one where every character was chosen independently of the others — no word hiding inside, no pattern linking one character to the next. That independence is the entire security argument. With sixteen characters drawn from eighty-odd symbols, the number of possible combinations is so large that trying them all is not a plan, it is a fantasy — even for attackers with serious hardware.
Entropy is the yardstick, and it rewards length far more than decoration. Each extra character multiplies the search space by the pool size, so a twenty-character password of plain letters quietly outguns a twelve-character tangle of symbols. The meter on this page shows the maths live: under 40 bits is weak, 40–60 is fair for throwaway accounts, 60–80 is strong, and beyond 80 bits you are in very-strong territory for everyday use.
Features
- Length from 4 to 128 characters, set by slider or exact number — the two controls stay in sync automatically.
- Four independent character families — capitals, small letters, digits and symbols — each toggled on its own.
- Look-alike filter removing 0, O, 1, l, I and the pipe character, for passwords that may be read aloud or copied from paper.
- Guaranteed coverage: every family you enable appears at least once, dropped at a random position so sites with composition rules accept it first time.
- Live entropy meter with a plain-language strength label that responds to every single change.
- One-click copy with a visible confirmation, plus an instant ‘new password’ button — no form to submit, no waiting.
- Cryptographic randomness drawn evenly with rejection sampling, so no character is favoured over another.
Benefits
- Nothing to steal. Generation happens on your device — no account, no history file, no server log holding your new password.
- No sign-up, no limits. Make one password or a hundred, for yourself or a whole team being onboarded.
- Learn as you go. Watching the entropy move teaches you to judge passwords by length rather than by symbol confetti.
- Works offline. Once the page is open, an unreliable connection changes nothing.
Who can use it
Anyone creating an account, replacing a password caught in a breach, or retiring a favourite that has been reused across too many sites. It suits the people who hand out credentials too — developers seeding test accounts, managers issuing temporary logins, support staff resetting access. If a secret needs to exist and nobody should be able to guess it, this is the fastest honest way to mint one.
How to use
- Set the length first — sixteen is a solid everyday default; go past twenty for email, banking and your password manager itself.
- Toggle the character families. If a site forbids symbols, switch them off and add length instead; the meter shows exactly what the trade costs.
- Enable the look-alike filter if the password might ever be typed by hand or read over the phone.
- Check the strength label, press Copy, and paste the result straight into the account or your password manager.
- Want another roll of the dice? Press New password — every generation is an independent draw.
Frequently asked questions
Is generating a password on a web page actually safe?
On this page, yes — because the page does the work and keeps it. The randomness comes from your browser's built-in cryptographic source, the finished password exists only on your screen, and reloading the tab destroys it. You can prove the claim to yourself: load the page, pull the network cable, and keep generating.
How long should my password be?
Sixteen characters from mixed families is comfortably strong for an ordinary account. Reserve twenty-plus for the accounts that guard everything else: your email, your bank, and the master password of your password manager. Those three can reset the rest of your digital life, so they deserve the longest secrets.
Do symbols really matter?
Less than people think. Symbols widen the pool, which helps, but length helps far more for the same effort — a twenty-character letters-and-digits password beats a twelve-character symbol salad. Take the symbols when a site allows them, but never sacrifice length to get them.
What does ‘guaranteed coverage’ mean?
Some sites reject passwords missing a digit or a symbol. When you enable a character family, the generator forces at least one character from it into the result, placed at a random position. Your password passes those composition rules on the first try instead of the third.
Will the tool remember what it made?
No, and that is the point. There is no storage anywhere in the design — nothing written to your browser, nothing transmitted. Close the tab before copying and that password is gone forever, which is exactly how a generator should behave.
Can I reuse one generated password in several places?
Please don't. Reuse is the habit that turns one breached website into a skeleton key for your entire online life, because attackers test every leaked credential against hundreds of other services automatically. The moment one site you used falls, every other account sharing that password falls with it. Generate a fresh password per account and let a password manager keep the list — that is the whole point of having a generator this fast.
Conclusion
A good password is long, random and used in exactly one place. This tool handles the first two qualities in seconds — generous length, honest entropy, no human patterns — and the third is a promise only you can keep. Pick a strong setting, copy the result into a password manager, and move on with your day.