Password Generator (Strong, Random, Secure)

How this page is maintained

• Steps and copy are checked against the current tool behavior.
• Browser limits, file-size constraints, or compatibility gaps are documented when relevant.
• Unless a page explicitly says otherwise, files and text stay in the browser during processing.

How to Generate a Strong Random Password

Open the generator, set a length, tick the sets you need, and copy the result. It all runs in your browser through crypto.getRandomValues, so the password never crosses the network.

A worked example. Say a work policy wants 16 characters with uppercase, lowercase, numbers, and symbols. Set the length to 16 and turn on all four sets. One result:

k7#Rm2Qv!Tz9Lp4W

That string draws on 94 usable symbols, so it holds about 104.9 bits of entropy. An 8-character lowercase password such as mqxbvtrd draws on only 26 symbols per spot and holds about 37.6 bits. Each extra character multiplies the search space, so length does more work here than any other control on the page.

Why length beats punctuation. A 12-character password using all four sets holds about 78.7 bits. A 20-character one using only lowercase letters holds about 94. Many policies still demand a symbol, so give them one, but never trade away characters for it.

Settings a site will take. Lengths run from 8 to 64 characters. If you must type it by hand, turn on the option to avoid ambiguous characters so O and 0, or l and 1, cannot be mixed up. If a site rejects symbols, keep upper, lower, and numbers, and add length instead. When a bank caps you at 12 or 20, use the longest value it allows.

A short checklist

1. Set the length to 16 or more.
2. Turn on all four sets.
3. Paste it into your manager at once.
4. Check it with the password strength tester.
5. Use one password per account.

Habits that do the rest

1. Turn on two-factor where offered.
2. Change it only after a breach.
3. Never send one over chat or email.
4. Keep your manager behind a long phrase.

If old files still sit behind a password, removing a password from a PDF covers that cleanup, and this guide to creating strong passwords goes deeper.

What Actually Changes a Password's Strength in This Tool

The generator builds one pool from the sets you tick, strips the ambiguous characters when that box is on, and draws each character from that pool with the Web Crypto API. The length slider runs from 4 to 64 characters, and that lower bound is the one number to ignore. A 4-character lowercase password covers only about 23.5 bits of guessing space, while 16 characters drawn from lowercase, uppercase, and numbers covers about 94.1 bits. The second password is not four times harder to guess; it is roughly 2 to the power of 70 times harder.

The set toggles matter far less than the length. Going from a 59-character pool to the full 94-character pool at 16 characters adds about 10.8 bits, while spending the same effort on two extra lowercase characters adds about 16.9 bits. Length is the control worth moving; the pools are there to satisfy a site that rejects the result.

Keeping the Trade-off Straight

Turning off the ambiguous filter widens the pool from 59 to 94 characters, worth about 10.8 bits at 16 characters. Leaving it on removes uppercase O, uppercase I, lowercase l, the digits 0 and 1, so nothing in the result can be misread as something else when someone has to retype it from a screen or read it aloud. That is a reasonable price for a password that goes into a manager by copy and paste, and it is a good trade for one you have to type by hand on a device without the manager.

Two habits cost nothing and beat any setting on the page. Give every account its own password so one breach cannot be replayed elsewhere, and turn on two-factor authentication wherever it is offered. If a site refuses symbols, keep upper, lower, and numbers and add characters instead. If it caps length at 12, that is a ceiling you cannot argue with, so put the account behind two-factor and change the password if the site reports a breach. The generation runs on your device and the password is never transmitted, so there is no copy to leak from a server. To see how a candidate scores against known patterns, run it through the password strength tester, and for the wider picture read how to generate strong passwords.

Key features

• Customizable rules: Choose the length and which character sets to include so you can match work policies or personal preferences.
• Readable or complex: Exclude ambiguous characters like O/0 or l/1 when you need something easier to type, or keep them for maximum entropy.
• Local generation: Passwords are generated in your browser using `crypto.getRandomValues` and are not included in site analytics events. The site separately collects usage information as described in the Privacy Policy.

Frequently asked questions

Related guides

• How to Generate Strong Passwords Free Online (Secure Password Generator 2026)

  Secure your accounts with our Strong Password Generator. Data breaches are happening more frequently than ever. The first line of defense for your digital life is a strong, unique password for every account. But coming up with random strings of characters on your own is difficult, and humans are notoriously bad at being random. The Strong Password Generator in JW Tool Box makes it easy to crea…