Secure Password Generator

Details

About this tool

Generates passwords to a policy you set: length, how many at once, which character groups to include, and whether to leave out the characters that are easy to misread. Every group you enable is guaranteed to appear at least once.

Length is what actually makes a password strong, and by a wider margin than most advice suggests. Each extra character multiplies the number of possibilities by the size of the alphabet, so adding one character does more than any amount of rearranging. A twelve-character random password drawn from the full alphabet is already beyond brute force for anything but a determined attacker with a leaked hash; sixteen to twenty is the sensible default, which is why this one starts at twenty.

What does not make a password strong is looking complicated. Substituting @ for a and adding a 1 to the end is the first thing every cracking dictionary tries, because those rules were published decades ago and every tool implements them. "Tr0ub4dor&3" is weaker than four unrelated words, and a memorable pattern is memorable to software too. The only reliable source of strength is real randomness, which is what this uses.

The ambiguous-character option removes the pairs that cause trouble when a password is read aloud or copied by hand - O and 0, l and 1 and I. It costs a little entropy, which the extra length more than covers, and it saves the phone call about a password that will not work.

Randomness comes from crypto.getRandomValues, the browser's cryptographic generator, not from Math.random - the latter is predictable from a handful of outputs and has no business generating a credential. Nothing is sent anywhere and nothing is stored, which is verified by a test that fails the build if any request from this page carries a generated password. The right place for the result is a password manager: a strong password you cannot remember is only useful if something remembers it for you.

Good to know

Questions people actually ask

Are generated passwords sent to a server?

No. They are generated in your browser and never transmitted or stored. An automated test fails the build if any network request from this page contains a generated password - the guarantee is enforced, not promised.

Does every selected character group appear?

Yes. If you enable digits and symbols, at least one of each is present in every password. Without that guarantee a random draw occasionally produces a password with no digit in it, which a system with a complexity rule then rejects - and the usual response is for someone to edit it by hand, which is exactly what weakens it.

How long should a password be?

Sixteen to twenty characters for anything that matters, and longer for a password manager's master password or a disk encryption key. Length beats complexity: every extra character multiplies the search space, whereas swapping a letter for a symbol only rearranges it. Short passwords cannot be rescued by cleverness.

Is "P@ssw0rd1" a strong password?

No - it is one of the first things every cracking tool tries. Substitution rules like @ for a and 0 for o were published decades ago and are built into every dictionary attack, so a word with predictable substitutions is barely harder to guess than the word itself. Randomness is the only thing that helps.

Should I reuse a generated password?

Never. Reuse is what turns one company's breach into a compromise of every account you own, because attackers take leaked email and password pairs and try them everywhere. Use a unique password per site and a password manager to hold them - that is the whole reason a generator like this is useful.