Is it safe to use an online password generator?

It is safe when generation happens entirely on your device. This generator uses your browser’s crypto.getRandomValues and never sends anything over the network; you can verify by watching the network tab while generating, or by going offline first.

How long should a password be?

For accounts protected by a modern password manager, 16 random characters is a comfortable default and 20+ is effectively uncrackable offline. Length matters more than forced symbol rules; NIST SP 800-63B recommends allowing long passwords rather than mandating composition rules.

Should I exclude ambiguous characters?

Only if you expect to read the password aloud or type it by hand, for example a Wi-Fi key. Excluding lookalikes such as 0/O and 1/l slightly reduces entropy but prevents transcription mistakes.

Password Generator

Strong, random passwords with the character sets you choose. Generated with your browser's cryptographic randomness.

Runs entirely in your browser. Nothing you type or generate is ever sent to a server.

Length: 16

lowercase UPPERCASE digits symbols exclude lookalikes (0/O, 1/l)

How this password generator works

Every password comes from crypto.getRandomValues, the browser's cryptographically secure random number generator, with rejection sampling so every character is drawn uniformly. At least one character from each set you enable is guaranteed, and the result is shuffled so those guaranteed characters land in unpredictable positions.

The entropy readout under the password estimates strength in bits: the length multiplied by the log of the character-pool size. Every additional character multiplies the work an attacker faces; 16 random characters from the full pool is around 105 bits, far past what any offline rig can search. See how long yours would survive in the crack time calculator.

Random password or passphrase?

If a password manager fills it for you, random characters are ideal. If you have to remember or type it, a diceware passphrase of five or six words gives similar strength and is far easier to carry in your head, which is also what current NIST guidance favors over forced complexity rules.

And if you would rather earn your password the hard way, the Committee is accepting applications: play The Password Games.

Frequently asked questions

Is it safe to use an online password generator?: It is safe when generation happens entirely on your device. This generator uses your browser’s crypto.getRandomValues and never sends anything over the network; you can verify by watching the network tab while generating, or by going offline first.
How long should a password be?: For accounts protected by a modern password manager, 16 random characters is a comfortable default and 20+ is effectively uncrackable offline. Length matters more than forced symbol rules; NIST SP 800-63B recommends allowing long passwords rather than mandating composition rules.
Should I exclude ambiguous characters?: Only if you expect to read the password aloud or type it by hand, for example a Wi-Fi key. Excluding lookalikes such as 0/O and 1/l slightly reduces entropy but prevents transcription mistakes.