Theoretical entropy
H = L × log₂(N)
Password generator
Create one or several unbiased random passwords with crypto.getRandomValues: 8 to 128 characters, uppercase, lowercase, digits, symbols, optional exclusion of look-alike characters, entropy in bits and a strength level. Everything is generated in your browser.
- Clipboard
Generated password
Strength-
All generated passwords
Options
Without I, l, 1, O, 0 and o, easy to mix up.
Was this tool useful?
How does this tool work?
This generator creates random passwords of 8 to 128 characters from the character types you pick, up to 20 at a time. It is meant for anyone opening an account, rotating a credential or preparing initial logins, and it shows the resulting entropy so you can judge how strong the password really is.
Every character is drawn with crypto.getRandomValues, the cryptographic random generator of the Web Crypto API backed by the operating system, not with Math.random, which is predictable. To avoid modulo bias, the tool uses rejection sampling: a random value that would exceed the largest multiple of the alphabet size is discarded and drawn again. Without this, with 256 possible byte values and a 62-character alphabet, the first 8 characters would come up slightly more often than the others. The tool also guarantees that at least one character of each selected type appears, so a site will not reject the password for a composition rule.
The displayed entropy follows the formula length × log2(alphabet size). With uppercase, lowercase and digits the alphabet has 62 characters, about 5.95 bits per character, so a 20-character password reaches roughly 119 bits. Each extra character multiplies the number of combinations by the alphabet size, whereas adding symbols only brings a few tenths of a bit per character. The strength level is derived from this entropy; above 80 bits an exhaustive search is out of reach, and 128 bits leaves a comfortable margin even against very large resources.
How to use this tool
Set the length
Choose a length from 8 to 128 characters (20 by default). A new password is generated when the page opens and every time you change an option.
Pick the characters and the count
Turn uppercase, lowercase, digits and symbols on or off, exclude look-alike characters if needed and choose how many passwords to generate, from 1 to 20.
Check the entropy and copy
Review the entropy in bits and the strength level, then use the copy button to paste the password into your password manager or the sign-up form.
Theoretical entropy
Use cases
Create the password for a new account
Generate a unique password of 20 characters or more for an online account, then save it straight into your password manager so it is never reused anywhere else.
Type a password on a TV or console
Turn on the exclusion of look-alike characters (I, l, 1, O, 0, o) when you have to copy the password by hand, for example a WPA2 Wi-Fi key of 8 to 63 characters or a streaming account on a smart TV.
Prepare temporary logins for a team
Generate up to 20 passwords at once for test accounts or first-day access during onboarding, send them through a separate channel and require a change at first sign-in.
Examples
Settings and calculated result
Input
Length: 20; Uppercase (A-Z), Lowercase (a-z) and Digits (0-9) on; Symbols off; Exclude look-alike characters offResult
Alphabet: 62 characters; theoretical entropy: 20 × log₂(62) ≈ 119.08 bits; random password.Tips and best practices
- If a site rejects some symbols or caps the length, turn symbols off and make the password longer instead: two extra characters more than make up for it.
- Excluding look-alike characters slightly shrinks the alphabet; add one or two characters to keep the same entropy.
- Do not paste the generated password into a note, an email or a chat: store it directly in a password manager and clear the clipboard on a shared device.
Sources and references
Frequently asked questions
Is an online password generator safe?
This one is, because generation happens entirely in your browser with crypto.getRandomValues and makes no network request: the password is neither transmitted nor stored. You can even go offline after the page has loaded and the tool keeps working.
How long should a password be?
NIST SP 800-63B-4 (2025) requires at least 15 characters for a password used on its own and 8 characters when it is combined with a second factor. For passwords kept in a manager, 20 characters or more is a good habit since you never have to remember them.
What does entropy in bits mean?
Entropy measures how many combinations an attacker would have to try: n bits means 2 to the power of n possibilities, and every extra bit doubles the effort. It is only meaningful for a truly random password like the ones generated here; a password chosen by a human is far more predictable than its theoretical entropy.
Why exclude look-alike characters such as l, 1, O and 0?
Depending on the font these characters are easily confused, which causes mistakes when the password is read from a screen, dictated or typed on another device. The option removes them from the alphabet; the entropy loss is small and one or two extra characters make up for it.
Do I really need symbols?
No. Length matters much more: symbols add only a few tenths of a bit per character, while one extra character adds almost 6 bits. Keep them if the site accepts them, but a long password without symbols is still very strong.
Random password or passphrase: which is better?
For accounts stored in a password manager, a random password of 20 characters or more is ideal. For what you must remember yourself, such as the manager’s master password, a passphrase of several randomly chosen words is easier to memorise; this tool only generates character passwords.
Related tools
Keep going with these tools
Tools similar or complementary to this one.
Similar tools
Check how strong a password is: entropy, weak patterns, estimated time to crack and advice.
Security & privacyFeaturedUse this tool
Create a modern password policy: length, blocklists, passphrases, expiration and attempt limits.
Security & privacyUse this tool
Derive a salted PBKDF2-SHA-256 or SHA-512 password hash, or verify a password against an encoded value.
Security & privacyUse this tool
Read next
GuideBest practicesBeginner
Passwords: generation, strength and useful policies
Understand why length and uniqueness matter, how password managers, MFA and passkeys complement passwords, and how servers should store them.
29 August 20262 min
GuideBest practicesBeginner
Web security: understand the essential protections of a website
Understand the layers that protect a website: HTTPS, HTTP security headers, CSP, SRI, authentication, passwords and integrity.
29 August 20262 min
TutorialBest practicesBeginner
How to securely redact a PDF before sharing it
Learn why covering text is not enough, how secure PDF redaction removes sensitive information and why sanitization matters before sharing.
10 September 20262 min
GuideBest practicesIntermediate
OAuth 2.0, PKCE, JWT, JWK and JWKS: understand their roles
Understand how OAuth 2.0, PKCE, JWT, JWK and JWKS fit together: authorization, tokens, public keys and verification.
23 September 20262 min