Strong Password Generator

Cryptographically Secure

Generate strong random passwords with length, character sets, and ambiguous-char exclusion. Crypto randomness in your browser—free, no signup, nothing uploaded.

Generated passwords stay in your browser and are never uploaded. This is not a password manager.

StrengthVery strong

~103 bits · Characters 88

Skips I, l, 1, O, 0, o, and | so values are easier to type and read aloud.

  • Length
  • Options
  • Strength

Click the password to generate a new one

What is this tool?

This strong password generator creates random passwords with configurable length (8–128) and character groups: uppercase, lowercase, digits, and symbols. Randomness comes from the browser’s cryptographic API, not from Math.random.

Use the strength meter as a quick hint when you change options: it estimates entropy from length × charset size. It is not a dictionary or breached-password check, and this page is not a password manager substitute.

Optional Exclude ambiguous characters removes lookalikes (I, l, 1, O, 0, o, |) when you must type or dictate the value. Prefer a password manager for storage and autofill; copy once and leave the tab.

Common use cases

  • Create a high-entropy password for a new account, then paste into a password manager
  • Generate a one-time secret that must be typed from a screen or spoken over support channels (with ambiguous characters excluded)
  • Match a site’s character-class rules by toggling uppercase, digits, or symbols without weakening length more than necessary

How to use

  1. Set length with the slider (16+ recommended when the service allows it).
  2. Toggle character sets and, if needed, exclude ambiguous characters.
  3. Copy the password (primary action), or click the password / Regenerate for a new value.
  4. Store it in a password manager — do not reuse it across services.

Examples

SettingResult shapeNotes
Length 16, all sets onMixed letters, digits, symbolsDefault-style high entropy for manager paste.
Length 20, no symbolsAlphanumeric onlyCommon when a form rejects #, %, or quotes.
Length 12, exclude ambiguousNo 0/O/1/l/I/|Better for handwritten or spoken one-time codes.
Length 8, digits onlyNumeric PIN-likeStrength meter shows Weak — fine for demos, poor for accounts.

Practical pitfalls

  • Site rules that force short passwords hurt more than “must include a symbol”: prefer the maximum allowed length even if you drop a character class.
  • Turning on Symbols does not guarantee every password contains a symbol — each character is drawn independently from the pool (unique vs “complexity checkbox” mental models).
  • The strength bar is a charset×length heuristic, not zxcvbn or a breach check; treat it as UI feedback only.

References

Last reviewed: 2026-07-27

Frequently asked questions

How are passwords generated?
The tool uses the browser’s cryptographic random API (`crypto.getRandomValues`), not `Math.random`. Length and character-class toggles only change the pool of allowed symbols.
What length should I choose?
Prefer at least 16 characters for ordinary accounts, and longer (20–32+) for shared secrets, API tokens, or high-value admin access when the service allows it. Length usually matters more than adding one more symbol class.
Are generated passwords stored or uploaded?
No. Values are created and copied in your browser only. This page is not a password manager and does not sync, vault, or remember secrets.
When should I exclude ambiguous characters?
Enable “Exclude ambiguous characters” when you will type the password by hand or read it aloud (support calls, printed one-time codes). It removes lookalikes such as I/l/1 and O/0/o. Leave it off for password-manager paste when maximum entropy per character matters more.