Create strong, random passwords • Free and instant
This free password generator makes random, unpredictable passwords. The notes below explain how the code builds each one and what its strength numbers actually mean.
Strength has one useful unit: how many passwords a guesser must work through. The character pools on this page are 26 uppercase letters, 26 lowercase letters, 10 digits and 26 symbols, so with all four boxes ticked every position is drawn from a pool of 88 characters and a password L long has 88L possible values. Entropy in bits is L multiplied by log2 of the pool, and log2 of 88 is 6.46, so every character carries that many bits. That puts the default length at about 103 bits: against offline hardware testing 100 billion guesses a second, the search is measured in trillions of years.
The script first places one guaranteed character from every box you ticked, fills the remaining positions at random, then shuffles the whole string with a Fisher-Yates loop. The guarantee trims a small fraction of a bit, which no attacker can use. Every draw, the shuffle included, comes from Math.random(); the script never calls crypto.getRandomValues().
The coloured badge is a crude score, not an entropy figure. Inside generatePassword() a counter adds 25 for each box you tick, then 10 at length 8, 15 more at 12 and 25 more at 16; 100 or above prints Very Strong, 75 Strong, 50 Medium, less Weak. Because four ticks alone reach 100, a short password with every box ticked shows Very Strong on barely 22 bits, while sixteen letters-only characters show Strong. Trust the arithmetic above over the colour.
The tool script makes no network request of its own: there is no form and no fetch anywhere in it. The password is assembled in a variable, placed in the display box through textContent, and the Copy button hands it to navigator.clipboard.writeText(); nothing is sent anywhere. Google Analytics records only the fact that you generated or copied, never the characters. One consequence of the same design: generatePassword() runs as the page loads, so a password is on screen before your first click.
A long random string with symbols is not something anyone retypes from memory, and its value only arrives once a manager stores and fills it, which leaves you remembering a single master secret instead of several hundred. Generate the entry immediately, give the manager a long master passphrase of its own, and keep the recovery code offline on paper. Where a site offers two-step verification, add it; it defends the account even when somebody else guesses the password correctly.
Reuse. The strings this page produces survive offline guessing by many lifetimes, but if the same string sits on two accounts, a leak at the careless one opens the careful one. The other weak link is a site that stores passwords without a slow salted hash, which is the site's duty, not yours.
No. Length wins whenever the site allows it. Every extra character multiplies the search space by the whole pool, while dropping a single character class only trims the pool a little. Prefer longer over more exotic.
For ordinary accounts, yes, provided you never reuse the result. For banking or for the master entry of your password manager, generate inside the manager itself or an offline utility that draws from the operating system entropy pool, so the secret is never rendered into a web page at all.
Save it in your password manager's entry for that account immediately and let the manager fill the login. Do not park it in email, chat, a notes app, a screenshot or a plain file on disk; if a string is worth protecting, let the manager hold it so you never handle it twice.
A generated password is only as safe as what happens after it is generated: retyping it, reusing it, or keeping it somewhere that can be read. A hardware security key removes those steps. It is a WebAuthn credential bound to the site you register it on, so it does not work on a look-alike page, and it never leaves the device. The links below open an Amazon search in a new tab; prices and stock change hourly, and nothing here is a tested review.
As an Amazon Associate, Free Online Tools earns from qualifying purchases. Amazon links on this page are advertising links; we may earn a commission, at no extra cost to you. Recommendations are independent of that.