Password Generator

How this password generator works

Set the length, tick the character types you want, and a password appears immediately — there is no button to press to get started, and a new one is generated every time you change a setting. The refresh button gives you another password with the same settings; the copy button puts it on your clipboard.

Everything happens in your browser. The password is never uploaded, stored or logged, and it is deliberately never written into the page address — URLs get saved in browser history and handed to other sites in the referrer header, which is no place for a password. Closing the tab is all it takes to erase it.

Where the randomness comes from

Passwords are drawn from your browser’s cryptographically secure random number generator — the same facility that backs encryption keys. This matters more than it sounds. The ordinary random function built into JavaScript is fast but makes no security promise at all: given enough of its output, its future output can be predicted. A password generator built on it looks perfectly random on screen while being reproducible by anyone who cares to try.

Characters are also selected in a way that keeps every character in the alphabet equally likely. The naive approach — take a random number and divide by the alphabet size, keeping the remainder — quietly favours the characters at the start of the alphabet whenever the two don’t divide evenly. This tool discards and redraws instead, so the distribution stays flat.

Choosing a length

The slider runs from 5 to 128 characters. For anything that matters, treat 16 as a floor and go longer where the site allows it. Length buys more security than complexity does: a long password from a simple alphabet is generally harder to attack than a short one bristling with symbols. Short lengths are here for the sites that still impose a low maximum, and for throwaway accounts.

The options

• Character types — uppercase, lowercase, digits and symbols. One character from each type you tick is guaranteed to appear, so a password never comes back missing a type you asked for; that’s what usually trips a site’s “must contain a number” rule. The result is shuffled afterwards, so those guaranteed characters aren’t parked at the front.
• Exclude look-alike characters — leaves out the characters people misread for one another, in the groups they get confused within: 0 Q O o, 1 I l, S 5, Z 2 and B 8. Worth using for a password you’ll read off one screen and type into another, or read aloud. It shrinks the alphabet a little, so consider adding a character or two of length.
• Exclude symbols — type any symbols you want left out, with no separators. The field accepts symbols only. Useful when a site rejects particular ones, or when a symbol is awkward on your keyboard layout.

If you exclude so much that nothing is left to choose from, the tool tells you rather than returning something weaker than you asked for.

A note on storing what you generate

A strong random password is only useful if you don’t have to remember it. Put it straight into a password manager rather than reusing it, writing it down, or trying to memorise it — reuse across sites is the single failure that turns one site’s breach into all of your accounts.

Frequently asked questions

Are these passwords actually random?

Yes. They come from your browser's cryptographically secure random number generator (crypto.getRandomValues), the same facility used for encryption keys — not the ordinary Math.random, whose output can be predicted from values an attacker has already seen. Characters are drawn with a method that keeps every character equally likely, so no part of the alphabet is quietly favoured.

Is my password sent to your server?

No. It is generated in your browser and never leaves the page — not uploaded, not stored, not logged, and deliberately never placed in the address bar, since URLs are saved in browser history and passed to other sites in the referrer header. Close the tab and it's gone.

How long should my password be?

For an account that matters, 16 characters or more with a mix of character types is a sensible floor, and longer is better. Length helps more than complexity: a long password drawn from a smaller alphabet generally beats a short one full of symbols. The one place to go shorter is a site that imposes a low maximum.

What does "exclude look-alike characters" do?

It leaves out the characters people most often misread for one another, grouped by what they get confused with: 0 Q O o, 1 I l, S 5, Z 2 and B 8. Worth turning on for a password you'll read off a screen and type by hand, or dictate to someone. It slightly shrinks the alphabet, so add a character or two of length to compensate.

Why did my password come back shorter than I asked, or empty?

Because the exclusions removed everything there was to choose from. If you switch off every character type — or exclude so many characters that a selected type has none left — there is nothing to build a password out of, and the tool says so rather than quietly returning something weaker than you asked for.

Does every password contain each type I ticked?

Yes. One character is taken from each type you enable before the rest is filled in at random, so a password never comes back missing a type you asked for — which is what would otherwise trip a site's "must contain a number" rule. The result is then shuffled so those characters aren't stuck at the front.