Password generator
Runs in your browser; nothing is uploaded
Random passwords, API keys and tokens from your browser's secure random generator, with their real entropy.
Settings
Generated
Generating…
What makes a password or secret strong?
A random password's strength is measured in bits of entropy: the base-2 logarithm of how many passwords the same settings could have produced. 20 characters from the 90 letters, digits and symbols offered here give about 130 bits; a 6-digit PIN about 20. Each extra bit doubles the work for someone guessing.
Length matters more than anything else. Each character multiplies the possibilities by the size of the alphabet, while adding a character set only increases that size a little. That is why long random strings beat short clever ones, and why a password manager is the place to keep them.
The same applies to API keys, client secrets, webhook signing secrets and tokens. Nobody types them, so they should be long and fully random; 128 bits is a common minimum. Randomness must come from a cryptographically secure source: this tool uses the browser's crypto.getRandomValues(), never Math.random().
How to use this tool
- 1Set the length and choose the characters: A–Z, a–z, 0–9, symbols, and any extra characters you type. New values appear as you change the settings.
- 2Leave out look-alikes to drop
Il1|O0ofor passwords people have to read or type. Use every selected set at least once for systems that require it. - 3Or choose a preset: password, readable password, API key, hex token or PIN.
- 4Check the strength line, which shows the exact entropy of these settings, then copy the value. Generate (Ctrl+Enter) makes new ones.
- 5To make many at once, set How many (up to 1,000), then Copy all or Download (Ctrl+S).
Troubleshooting
- A system rejects some symbols
- Turn off Symbols and type only the symbols it accepts into Extra characters, then add a few characters of length to make up for the smaller alphabet. Quotes and backslashes are left out by default because they break shell and config strings.
- The entropy is lower with "every selected set" turned on
- Requiring each set rules out the passwords that miss one, so slightly fewer are possible. For 16 or more characters the difference is under a bit; for very short values it is larger, and the figure shown is exact.
- Can't generate with these settings
- Choose at least one set or type some characters, and make the length at least the number of selected sets when every set must appear.
Frequently asked questions
Are the passwords sent or stored anywhere?
No. They are generated in your browser after the page loads and are never sent or saved. Only your settings, such as the length, are remembered in this browser. Store the values you need in a password manager or secret store.
Is every character equally likely?
Yes. Each character is chosen with rejection sampling, which avoids the small bias of the common random % length method, and passwords that must contain every set are drawn again until they do rather than patched, so every valid password is equally likely.
How long should a password be?
For passwords kept in a password manager, 16 or more characters with all sets. For API keys and tokens, aim for at least 128 bits, such as 22 letters and digits or 32 hex digits.