Password Generator

How to generate a password

1. A password appears as soon as the page loads. Press Generate new for another one. Any change to the options also creates a fresh password automatically.
2. Drag the Length slider, which runs from 8 to 64 characters. The default is 16.
3. Tick the character types you want: lowercase a-z, uppercase A-Z, digits 0-9 and symbols. If a site refuses symbols, untick that box.
4. Switch on Avoid look-alikes if you will ever read the password aloud or type it from a printout.
5. Press Copy and paste it straight into your password manager or the site's form. The button says "Copied" for a moment to confirm.

If you untick every box the page shows "Select at least one type" instead of a password.

How the password is built

The generator never uses Math.random. Every choice comes from crypto.getRandomValues, the browser's cryptographically secure source of random numbers. It also avoids a subtle bias: when you map a random 32-bit number onto a list of, say, 85 characters with a simple remainder, the first few characters come up slightly more often. This tool throws away any random number that falls in the uneven leftover range and draws again, so every character in the pool is exactly equally likely.

The steps are: put together the pool from the ticked types, pick one character from each ticked type so that the result always contains every kind you asked for, fill the remaining positions from the whole pool, then shuffle all positions with a Fisher-Yates shuffle. The shuffle matters, because otherwise the guaranteed characters would always sit at the start.

The symbol set is exactly 23 characters: ! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . ?. Quote marks, slashes and angle brackets are left out on purpose, since they often cause trouble inside forms, shells and URLs.

Reading the entropy figure

Under the password you see something like "About 103 bits of entropy - excellent". The page computes it as length multiplied by log base 2 of the pool size, then rounds. A few worked examples:

• 16 characters from all four types (85 characters in the pool): 16 x 6.41 = about 103 bits, rated excellent.
• 12 characters from all four types: about 77 bits, rated fair.
• 16 lowercase letters only (26 in the pool): about 75 bits, rated fair.
• 16 letters and digits without symbols (36 in the pool if you tick only a-z and 0-9): about 83 bits, rated strong.
• 8 characters from all four types: about 51 bits, rated weak.

The labels are fixed thresholds: 100 bits and above is excellent, 80 and above strong, 60 and above fair, anything lower weak. Each extra bit doubles the number of guesses an attacker needs, so 103 bits is not slightly better than 77 bits, it is about 67 million times harder to guess. The figure is a close estimate rather than an exact measure, because forcing one character of each type slightly reduces the number of possible results.

When to use what

• Accounts kept in a password manager: use 20 or more characters with every type ticked. You never have to remember it, so there is no reason to make it short.
• A password you must type by hand, such as a Wi-Fi key for a guest or a TV login: turn on Avoid look-alikes, drop the symbols and go longer, for example 20 letters and digits.
• Sites with odd rules: some old systems cap the length at 12 or 16 characters or ban certain symbols. Match the limit, tick only what is allowed, and keep the length at the maximum.
• Master passwords that you do have to memorise are a poor fit for a random string of characters. A long passphrase of several unrelated words is easier to remember.

Tips and limits

• The Avoid look-alikes option removes 0, O, l, 1 and I from the pool. That shrinks it slightly (from 85 to 80 characters with everything ticked), costing about 2 bits at 16 characters.
• The page does not save, log or send the password. Closing or reloading the tab discards it, so copy it before you leave.
• Pasting a password into a plain notes app or a chat leaves a copy behind. Put it in the account form or a password manager and clear the clipboard afterwards if your device allows.
• A strong password cannot protect against phishing or a site that stores passwords badly. Use a unique password for every account and turn on two-factor authentication wherever it is available.

More questions