Random Password Generator

Features

• Length from 4 to 128, with lowercase, uppercase, digits and symbols each optional
• Live entropy readout in bits, recalculated as you change any option
• Every selected character class is guaranteed to appear at least once, then the result is shuffled, so no position is stuck on one class
• Optionally exclude the look-alikes 0 O 1 l I, useful when a password has to be copied by hand or read aloud
• Generate up to 50 passwords at once, guaranteed distinct, copied individually or all together
• Anything matching the common-password list is flagged per row rather than quietly passed through

How to use

1. Set the length, 16 or more is a good default
2. Tick the character sets you need, keeping at least one
3. Tick the look-alike exclusion if the password has to be typed by hand
4. Click Generate again for a new batch, then Copy on any row

FAQ

What is entropy and how much is enough?

Entropy measures how many attempts an attacker needs on average, in bits: n bits means roughly 2^(n-1) tries. As a rule of thumb, anything under 40 bits falls to a single graphics card in hours, 60 bits and up resists online guessing, and 80 bits and up is out of reach for current hardware. All four character sets at length 16 give about 105 bits, which is the number shown on the page. Unlike the word strong, it can be compared directly.

Are generated passwords stored or uploaded?

No. Randomness comes from crypto.getRandomValues, a cryptographically secure source, and generation and display both happen in memory on your machine. The page makes no network requests, and reloading clears the list, so nothing ends up in a server log.

Why can Math.random not be used for passwords?

It is not a cryptographically secure source. Its internal state can be recovered from a few hundred outputs, after which every generated password becomes predictable, and the mistake raises no error at all: the generator looks perfectly healthy. This tool, like every tool on this site that needs randomness, uses crypto.getRandomValues only.

Will a batch of 50 contain duplicates?

No. Any password that repeats within a batch is discarded and regenerated. With the current ranges, a length of at least 4 and a character set of at least 8 characters, producing 50 distinct values is never a problem.

What should I do with the password afterwards?

Use one per account, never reuse them, and store them in a password manager rather than a chat message. If a site rejects symbols, drop symbols and add length instead, since length buys more entropy than symbols do. When a site imposes a maximum length, generate at that maximum and keep the character sets wide.