Strong Password Generator
Cryptographically Secure
Generate strong random passwords with length, character sets, and ambiguous-char exclusion. Crypto randomness in your browser—free, no signup, nothing uploaded.
Generated passwords stay in your browser and are never uploaded. This is not a password manager.
~103 bits · Characters 88
Skips I, l, 1, O, 0, o, and | so values are easier to type and read aloud.
- Length—
- Options—
- Strength—
Click the password to generate a new one
What is this tool?
This strong password generator creates random passwords with configurable length (8–128) and character groups: uppercase, lowercase, digits, and symbols. Randomness comes from the browser’s cryptographic API, not from Math.random.
Use the strength meter as a quick hint when you change options: it estimates entropy from length × charset size. It is not a dictionary or breached-password check, and this page is not a password manager substitute.
Optional Exclude ambiguous characters removes lookalikes (I, l, 1, O, 0, o, |) when you must type or dictate the value. Prefer a password manager for storage and autofill; copy once and leave the tab.
Common use cases
- Create a high-entropy password for a new account, then paste into a password manager
- Generate a one-time secret that must be typed from a screen or spoken over support channels (with ambiguous characters excluded)
- Match a site’s character-class rules by toggling uppercase, digits, or symbols without weakening length more than necessary
How to use
- Set length with the slider (16+ recommended when the service allows it).
- Toggle character sets and, if needed, exclude ambiguous characters.
- Copy the password (primary action), or click the password / Regenerate for a new value.
- Store it in a password manager — do not reuse it across services.
Examples
| Setting | Result shape | Notes |
|---|---|---|
| Length 16, all sets on | Mixed letters, digits, symbols | Default-style high entropy for manager paste. |
| Length 20, no symbols | Alphanumeric only | Common when a form rejects #, %, or quotes. |
| Length 12, exclude ambiguous | No 0/O/1/l/I/| | Better for handwritten or spoken one-time codes. |
| Length 8, digits only | Numeric PIN-like | Strength meter shows Weak — fine for demos, poor for accounts. |
Practical pitfalls
- Site rules that force short passwords hurt more than “must include a symbol”: prefer the maximum allowed length even if you drop a character class.
- Turning on Symbols does not guarantee every password contains a symbol — each character is drawn independently from the pool (unique vs “complexity checkbox” mental models).
- The strength bar is a charset×length heuristic, not zxcvbn or a breach check; treat it as UI feedback only.
References
Last reviewed: 2026-07-27
Frequently asked questions
- How are passwords generated?
- The tool uses the browser’s cryptographic random API (`crypto.getRandomValues`), not `Math.random`. Length and character-class toggles only change the pool of allowed symbols.
- What length should I choose?
- Prefer at least 16 characters for ordinary accounts, and longer (20–32+) for shared secrets, API tokens, or high-value admin access when the service allows it. Length usually matters more than adding one more symbol class.
- Are generated passwords stored or uploaded?
- No. Values are created and copied in your browser only. This page is not a password manager and does not sync, vault, or remember secrets.
- When should I exclude ambiguous characters?
- Enable “Exclude ambiguous characters” when you will type the password by hand or read it aloud (support calls, printed one-time codes). It removes lookalikes such as I/l/1 and O/0/o. Leave it off for password-manager paste when maximum entropy per character matters more.