Free Online Password Generator
Generate cryptographically secure random passwords of any length. Choose your character sets, generate up to 20 passwords at once, and see the entropy estimate for each configuration. Passwords are never sent to any server.
Password Length: 16
Character Sets
Number of passwords: 1
How Password Strength is Calculated
Password strength is measured in bits of entropy: entropy = length × log₂(charset size). A larger charset and a longer password both increase the number of possible combinations an attacker must try in a brute-force attack.
- Lowercase only (26 chars): log₂(26) ≈ 4.7 bits per character
- Lowercase + uppercase + digits (62 chars): log₂(62) ≈ 5.95 bits per character
- All sets including symbols (88 chars): log₂(88) ≈ 6.46 bits per character
A 16-character password with all character sets enabled provides around 103 bits of entropy — far beyond the reach of any current or near-future brute-force attack.
Why Randomness Matters
This tool uses crypto.getRandomValues() — the browser's cryptographically secure pseudo-random number generator (CSPRNG), the same source used by encryption libraries. Unlike Math.random(), which is not suitable for security purposes, a CSPRNG produces output that is computationally infeasible to predict.
Password Best Practices
- Use a password manager: A password manager lets you use a unique, complex password for every account without memorizing them.
- Never reuse passwords: A breach at one service exposes every other account that shares the same password.
- Aim for 16+ characters: Length is the single biggest factor in password strength. 16 random characters beats a "complex but short" password every time.
- Enable MFA: Even a strong password can be phished. Multi-factor authentication adds a layer that password strength alone cannot provide.
Frequently Asked Questions
Aim for at least 16 characters with all character sets enabled — that gives roughly 103 bits of entropy, far beyond what any realistic brute-force attack can crack. Length matters more than complexity: a longer password with fewer symbol requirements beats a short "complex" one every time.
No. Passwords are generated and displayed entirely in your browser — nothing is sent to a server, logged, or stored anywhere. Once you navigate away without copying, the password is gone.
It uses crypto.getRandomValues(), the browser's cryptographically secure pseudo-random number generator (CSPRNG) — the same class of randomness source used by encryption libraries. Math.random() is not suitable for security purposes and is deliberately not used here.
Yes, generate up to 20 passwords in a single click, each with its own entropy estimate, and copy any of them individually.
It's completely free with no limits and no account required. Since generation happens locally in your browser, there's nothing to sign up for.