Generators
Password Generator
Generate strong passwords with length, symbols, numbers, and similar-character exclusion options.
Strength: Strong
Choose options, then click Generate.
About the password generator
Set a length between 8 and 128 characters, choose which kinds of characters to include and click Generate. You get five passwords at once, each with its own copy button. The options are uppercase letters, lowercase letters, digits and 24 symbols such as ! @ # $ % and brackets, plus a switch that leaves out look-alikes: zero, capital O, lowercase l, capital I and the digit 1. Each character is picked with crypto.getRandomValues, the browser's cryptographically secure random number generator, so the passwords are made on your device. They are never sent to a server or saved. Copy the one you want into your password manager before you leave the page, because it is gone once you do. With all four sets switched on there are 86 possible characters, about 6.4 bits of randomness each. A 16 character password then has roughly 103 bits and a 20 character one about 128, far beyond what any guessing attack can get through. The strength label uses a simpler rule: Strong means at least 20 characters with digits and symbols on, Good means at least 14 characters, and anything shorter shows Weak.
Frequently asked questions
How long should my password be?
NIST's digital identity guidelines (SP 800-63B-4) tell sites to require at least 15 characters when a password is the only login factor and at least 8 when it is used together with a second factor, and to accept passwords of 64 characters or more. A random 16 to 20 character password from a password manager clears that easily.
Should I exclude similar characters?
Only if the password will be read or typed by hand, like a Wi-Fi password on a printed card. Leaving out 0, O, l, I and 1 drops the pool from 86 to 81 characters, so a 20 character password goes from about 128 to 127 bits. That makes no practical difference. If a password manager fills it in, leave the switch off.
Do I need symbols and mixed case?
Length matters more. The NIST guidelines tell sites not to force mixes of character types at all. Symbols add strength per character, but some sites reject certain symbols, and then a longer password of letters and digits does the job: 20 random lowercase letters and digits give about 103 bits.
Is it safe to generate a password on a website?
Here the password is created in your browser and never travels over the network. You can check: open your browser's developer tools, watch the Network tab and click Generate. The page sends a small note that the tool was used, and no request carries the password.