Secure Password Generator

What this generator does

Builds a random password from character types you choose, in your browser, and never transmits or stores it. It is intended for creating a genuinely unguessable password to paste straight into a password manager, rather than for inventing something you will memorise — the passphrase generator is the better tool when a human has to type it from memory.

How to use this tool

1. Choose a password length.
2. Select which character sets to include: lowercase, uppercase, digits, symbols.
3. Optionally exclude ambiguous characters like l, 1, O and 0.
4. Generate, then copy your password with one tap.

Understanding the controls

Password length

The single biggest factor in how hard a password is to guess — each extra character multiplies the number of possibilities. Increasing the length helps far more than adding another character type to a short password.

Lowercase, Uppercase, Digits, Symbols

Which character sets the password may draw from. Turning a set on widens the pool every character is drawn from; it does not guarantee that every set appears in a short password, though the generator does try to include each set you enable.

Exclude ambiguous characters

Removes characters that are easily confused when read or transcribed — the digit 1 against a lowercase l, the digit 0 against a capital O. Useful for a password you will read aloud or copy by hand, at the cost of a slightly smaller character pool.

Worked examples

A everyday account password

16 characters, lowercase + uppercase + digits. Long enough to be well beyond guessing, and still typeable if you ever have to enter it by hand.

Where symbols are required

Turn symbols on if a site demands them. Adding symbols helps less than adding length — going from 12 to 16 characters does more than adding one symbol to a 12-character password.

Reading a password aloud or copying it by eye

Turn on 'exclude ambiguous characters' to drop i, l, 1, L, o, 0 and O, which are the pairs people most often mistype.

Common use cases

• Creating a new account password
• Replacing a weak or reused password
• Generating passwords for a password manager

How this generator works

You choose which character sets to include, and those are combined into a single pool. Each character of the password is then drawn independently from that pool using your browser's Web Crypto random generator — the same source of randomness browsers use for security work — with the range-selection step corrected so no character is more likely than any other. Because every position is independent, each extra character multiplies the number of possible passwords rather than merely adding to it, which is why length is the single most effective setting on this page.

Randomness and fairness

Every character is chosen with your browser's cryptographic random number generator, drawn uniformly from the enabled sets using rejection sampling so no character is quietly more common than another. There is no seeded or reproducible mode here, by design: reproducibility is the opposite of what a password needs, and offering it would let someone regenerate your password from a seed.

For how randomness is produced across the whole site, see how Generate Random works.

Limitations and good to know

• This tool cannot tell you whether a password has appeared in a known data breach — it only creates new random ones, and never checks any external service.
• A strong password does not protect an account on its own. Reuse across sites, phishing, and a breach at the service itself all defeat it, so turn on two-factor authentication where it is offered.
• Nothing is saved. Once you close or reload the page the password is gone, so store it in a password manager before you navigate away.
• No password is unbreakable — length buys time against guessing, it does not make an account permanently safe.

Common mistakes

Assuming a long password is automatically accepted

Plenty of services cap password length or reject particular symbols. If a password is refused, shorten it or turn off symbols rather than assuming the generator produced something invalid.

Generating a password and then editing it by hand

Changing a few characters to make it memorable undoes much of the point — the strength comes from the whole string being unpredictable. Generate, copy, and store it somewhere you can retrieve it.

Practical tips

• Paste straight into a password manager rather than into a document or a note; the clipboard is the shortest path and leaves the fewest copies behind.
• A password you cannot remember is fine if it is stored properly. If you genuinely need to memorise it, use the passphrase generator instead, which trades character variety for something a person can recall.

Privacy and your data

The password is generated on your own device and is never sent anywhere. It does not appear in the page address, is not written to storage, and is never included in analytics — the analytics layer rejects any attempt to send a field named like a password outright. Closing the tab is enough to remove it; nothing persists.

Frequently asked questions

Is my generated password sent anywhere?

No. Password generation runs entirely in your browser using the Web Crypto API. Nothing is transmitted to a server, logged, or included in analytics.

What makes a password strong?

Length and unpredictability matter most. A longer password using a wide mix of character types is exponentially harder to guess than a short, predictable one — but no password is truly unhackable, so use a unique password per account and consider a password manager.