Why password strength matters more than ever
The average person has over 100 online accounts. Most people reuse the same three or four passwords across all of them — often with minor variations like adding a number at the end. This is how breaches happen. When one site is compromised, attackers use the leaked credentials to try every other site automatically. This is called credential stuffing, and it's responsible for the majority of account takeovers today.
The solution is simple in theory but hard in practice: use a unique, strong, random password for every account. Our free password generator makes the random part instant. You still need a password manager to handle the "unique for every site" part — but generating the passwords themselves is where we help.
What makes a password genuinely strong?
Password strength comes down to two things: length and character set size. Together these determine the number of possible combinations an attacker would have to try — this is what the entropy score measures.
Password length
Length is the single biggest factor. Every additional character multiplies the number of possible passwords exponentially. An 8-character password using uppercase, lowercase, numbers, and symbols has about 52 bits of entropy — enough to resist casual attacks but vulnerable to determined adversaries with GPU clusters. A 16-character password with the same character set has over 104 bits of entropy — effectively uncrackable with current technology.
Most security experts today recommend a minimum of 16 characters for important accounts. For critical accounts (banking, email, password manager master password), 20+ characters is better.
Character set diversity
Using all four character types — uppercase, lowercase, numbers, and symbols — maximises the pool of possible characters and makes brute-force attacks much harder. A password using only lowercase letters has a character pool of 26. Adding uppercase brings it to 52. Adding numbers gives you 62. Adding common symbols takes it to 94 or more. Each expansion of the character pool dramatically increases the number of possible passwords for any given length.
True randomness
This is where most people's manually created passwords fail. Humans are terrible at generating random sequences — we unconsciously follow patterns, avoid certain characters, and gravitate toward familiar combinations. Our random password generator uses the browser's built-in cryptographic random number generator (`window.crypto.getRandomValues`) which produces cryptographically secure random output. This is the same level of randomness used by security software and hardware security modules.
Understanding the entropy score
Most password tools show you "Weak / Medium / Strong" labels without explaining what they mean. We show you the actual entropy in bits — a precise mathematical measure of how difficult the password is to guess by brute force.
Entropy is calculated as: log₂(character pool size) × password length. For a 16-character password using all character types (pool of ~94 characters), the entropy is approximately log₂(94) × 16 = 104 bits.
Here's what the entropy ranges mean in practice:
- Under 28 bits — Weak. Crackable in seconds on modern hardware.
- 28–35 bits — Fair. Crackable in minutes to hours. Not suitable for anything sensitive.
- 36–59 bits — Strong. Resistant to most attacks. Suitable for general use.
- 60+ bits — Very strong. Practically uncrackable with current technology. Use for critical accounts.
Advanced features that set this tool apart
Bulk password generation
Switch to the "Bulk generate" tab and create 5, 10, or 20 passwords at once. Each password has its own individual copy button so you can pick the ones you want and copy them one at a time. This is particularly useful for system administrators, developers setting up test accounts, or anyone who needs multiple unique passwords in a single session.
Almost no free random password generator offers this. Most tools generate one password at a time and require you to click refresh repeatedly.
Exclude ambiguous characters
When you check "Exclude ambiguous characters", the tool removes 0, O, l, 1, and I from the character pool. These characters look similar across different fonts and can cause confusion when you need to type a password manually — for example, on a TV remote, a mobile device, or any situation where you can't copy-paste. Enabling this option makes your passwords easier to read and type without significantly reducing their strength.
No repeated characters
The "No repeated characters" option ensures every character in the generated password appears exactly once. This slightly reduces the mathematical entropy compared to a standard random password of the same length, but can produce passwords that feel more varied and are sometimes easier to remember. Note that this option requires the password length to be shorter than the character pool size — if you enable it with a very long password, the tool will use the maximum available unique characters.
Real cryptographic randomness
We use `window.crypto.getRandomValues()` — the same API used by browsers' own password managers and security-critical applications. This is not the same as JavaScript's standard `Math.random()`, which is a pseudorandom generator not suitable for security applications. Everything runs locally in your browser. Your passwords are never transmitted anywhere.
How to use your generated passwords
A strong random password generator is only as useful as your system for storing and using the passwords it creates. Here's the recommended workflow:
- Generate a strong password here — 16+ characters, all character types enabled.
- Copy it immediately and paste it into your password manager (Bitwarden, 1Password, Dashlane, KeePass, etc.).
- Use the password manager to fill in the new password when creating or updating your account.
- Never reuse it — generate a new unique password for every site.
If you don't use a password manager yet, this is the moment to start. The combination of a strong secure password generator and a password manager solves the two fundamental problems of password security: strength and uniqueness.
Frequently asked questions
Yes. The tool uses the browser's `window.crypto.getRandomValues()` API, which produces cryptographically secure random numbers. This is not the same as JavaScript's `Math.random()` — it's the same level of randomness used by hardware security modules and professional security software.
No. Everything happens inside your browser. The passwords are generated in memory, displayed on screen, and discarded when you navigate away. Nothing is sent to any server. You can safely generate passwords for your most sensitive accounts.
For general accounts, 16 characters is a solid minimum. For critical accounts — your email, banking, and password manager master password — use 20 or more characters. Length is the most important factor: a 20-character password with all character types is many orders of magnitude stronger than a 12-character password.
Entropy measures how many guesses an attacker would need to crack your password by brute force. It's expressed in bits — each additional bit doubles the number of required guesses. A password with 60 bits of entropy requires 2⁶⁰ guesses (over a quintillion), which is computationally infeasible with current technology. Our tool shows you the exact entropy so you can make an informed decision about your password's strength.
It removes characters that look similar in many fonts — specifically 0 (zero), O (capital o), l (lowercase L), 1 (one), and I (capital i). These are useful to exclude when you need to type a password manually, such as on a device where copy-paste isn't available. Excluding them slightly reduces entropy but makes the password much easier to read and enter without mistakes.
Yes, absolutely. A strong password generator solves the randomness problem — but you also need a way to store and recall unique passwords for every account. A password manager like Bitwarden (free and open source), 1Password, or Dashlane stores all your passwords securely so you only need to remember one master password. Use this generator to create the passwords, and your password manager to store them.