Password Generator

Length is the only dial that matters

Password strength is an entropy bill, and entropy grows with length. This page generates a password of 8 to 64 characters in your browser, from an alphabet that leaves out the confusable glyphs — no uppercase I or O, no lowercase l, no digit 0 or 1 — and reports the entropy in bits. The alphabet is 57 characters without symbols (24 uppercase + 25 lowercase + 8 digits) and 75 with symbols added, and the bits figure is just length × log₂(alphabet): a 20-character password with symbols carries about 125 bits, one without carries about 117. Both are far beyond brute-force reach for a targeted attack.

The draws come from your browser's cryptographic generator, the exact machinery the Random Number Generator page uses for fair picks — with a rejection loop so no character is ever more likely than another. Everything happens locally: nothing is transmitted, logged or learned from the result. What you do with the password next is the security decision that actually matters.

A worked example, step by step

Scenario: you are creating the master password question — or rather choosing the length — for a password manager vault.

1. Pick length 20, symbols: yes. Press Generate; copy to your password manager straight away.
2. Entropy: 20 × log₂(75) ≈ 20 × 6.229 = 124.57 → the panel shows 125 bits.
3. Same length without symbols: 20 × log₂(57) ≈ 116.65 → 117 bits. Both are unguessable; the 8-bit difference is second order.
4. Sanity-check the alphabet: with symbols the character set is 57 + 18 = 75 entries, where 18 is the count of safe symbols in the tool's roster.
5. Storage decision: paste into the manager, never into a notes app; the tool's own detail line repeats the warning for a reason.

The panel also prints the reminder that a refreshed page loses the generated string — a deliberate prompt to commit it to the manager before you browse on.

Bits by length, both alphabets

Read the first and last rows together: going from 8 to 32 characters multiplies strength by four on the same dial — and the missing 0/1/I/O/l glyphs cost almost nothing in entropy while saving hours of support tickets about "the password I copied doesn't work".

The manager habit, plainly stated

The single highest-impact advice on this page: use a password manager, and never reuse passwords across sites. A unique generated password per account caps the blast radius of any one breach; a repeated password converts one breach into dozens. Second, enable multi-factor authentication wherever it exists — a strong password plus MFA converts most credential attacks into dead ends. Third, treat generated secrets as ephemeral until stored: the browser caches nothing here, so the clipboard is the only transient stop, and the manager is the only long-term home.

Mistakes that quietly waste a strong password

• Reusing it. The strongest password in the world leaks at the weakest site that holds it.
• Saving it in plaintext. Notes apps, spreadsheets and screenshots undo the 125 bits instantly.
• Trading length for clever substitutions. "P@ssw0rd!" is weaker than 16 honest random characters; blind character-swaps are low-entropy theatre.
• Regenerating on a whim. A password that keeps changing loses the accountability story; change on evidence of compromise instead.
• Losing it before storing. Refreshing the page without copying is the most common self-inflicted loss the tool hints about.

Keep exploring

• Random Number Generator — fair integer draws from the same crypto generator.
• Statistics Calculator — summarise entropy across a family of generated passwords for a policy review.
• Unix Timestamp Converter — when a credential was rotated, as a readable date.
• Guide: Password Safety Basics.