Free Strong Password Generator

Generate a cryptographically secure random password right in your browser. Pick a length and character sets, and the tool uses crypto.getRandomValues with rejection sampling for unbiased, high-entropy output. Everything runs locally; nothing is uploaded or stored.

About this Password Generator

Humans are famously bad at inventing random passwords. We reach for words, dates, and keyboard patterns — exactly the things password-cracking tools try first. This free Password Generator removes the human from the loop: it asks your browser's cryptographically secure random number generator (crypto.getRandomValues, part of the Web Crypto API) for random bytes and maps them onto your chosen character pool. The result is a password with no structure to exploit, whose strength can be measured precisely in bits of entropy.

Everything happens on your device. There is no API call, no analytics event carrying the password, and no storage — the password exists only in the box above until you copy it. Refreshing the page discards it forever.

How the generator avoids modulo bias

A common mistake in homemade generators is mapping a random byte (0-255) onto a character pool with byte % poolSize. Unless the pool size divides 256 evenly, the first few characters of the pool come up slightly more often — a small but real bias that reduces effective entropy. This tool uses rejection samplinginstead: any byte greater than or equal to the largest multiple of the pool size below 256 is simply discarded and a fresh byte is drawn. Every character in the pool is exactly equally likely.

Reading the entropy meter

Entropy measures how many guesses an attacker would need on average. It is calculated as length × log2(poolSize) — each character contributes log2(poolSize) bits. The meter uses these bands:

• Weak (under 50 bits) — crackable offline in hours to days with modern GPU rigs. Avoid for anything that matters.
• Fair (50-69 bits) — acceptable for low-value accounts protected by rate limiting, but not for offline-attackable secrets.
• Strong (70-89 bits) — a good default for most accounts.
• Very strong (90+ bits) — appropriate for password-manager master passwords, disk encryption, and long-lived secrets.

Notice how the meter responds as you drag the length slider: going from 12 to 20 characters does far more than toggling the symbols checkbox. Length multiplies the search space per character; complexity only enlarges the pool a little. When in doubt, make it longer.

Why exclude ambiguous characters?

The characters 0/O and 1/l/I look nearly identical in many fonts. If a password will ever be read aloud, printed, or typed from a screen (Wi-Fi passwords, temporary credentials shared over a call), excluding them prevents frustrating transcription errors. The entropy cost is tiny — the meter updates so you can see exactly how tiny. For passwords that live only in a password manager, there is no reason to exclude anything.

Tips for using generated passwords well

• Use a password manager. A unique random password per site is only practical if software remembers them for you. Generate, store, forget.
• Never reuse a password — credential-stuffing attacks replay leaked passwords against every popular service.
• Enable two-factor authentication where offered; even a very strong password benefits from a second factor.
• Prefer length over rules. If a site forces short passwords with complexity rules, max out the allowed length anyway.
• Regenerate freely. Passwords here are free and instant — if one gets pasted somewhere questionable, just make a new one.

FAQ: Password Generator