Strong Password Generator
Generated in your browser from the cryptographic random source. Nothing is sent anywhere.
Press Generate to produce a set.
Where these passwords come from
Every character is drawn from crypto.getRandomValues, the browser's cryptographic random source. That distinction matters more than any option on this page. The ordinary Math.random is a fast, predictable generator: given enough of its output, the rest can be worked out. A password built with it is far weaker than its length suggests, and a great many password generators use it anyway.
There is a second, quieter mistake worth naming. Turning a random number into a character with a plain modulo makes the first few characters of the alphabet slightly more likely than the rest, because the range does not divide evenly. Here the values that would cause that bias are discarded and redrawn, so every character really is uniform.
Nothing leaves the page
Generating a password on a website is only defensible if the password never reaches the website. There is no backend for this tool, no request is made when you press generate, and nothing is stored in the browser between visits. Close the tab and the passwords are gone. If you would rather not take that on trust, disconnect from the network before generating: the page will keep working, which is the point.
How long is long enough
Entropy, measured in bits, is the honest way to answer this. It counts how many equally likely passwords your settings could produce, expressed as a power of two, and each extra bit doubles the work an attacker faces.
| Entropy | Verdict | Roughly |
|---|---|---|
| Under 50 bits | Weak | Within reach of a determined offline attack |
| 50 to 70 bits | Fair | Fine for a low-value account with rate limiting |
| 70 to 100 bits | Good | Comfortable for ordinary accounts |
| Over 100 bits | Strong | Appropriate for a password manager master key |
A 20-character password using all four character sets lands around 130 bits, which is why the default is set there. Note that this figure describes the generator, not a password you invented: entropy assumes every character was chosen at random, and a human-chosen password with the same length and character mix is worth a fraction of it.
Choices worth understanding
Symbols versus length
Adding symbols to letters and digits takes the alphabet from 62 characters to about 94, which is roughly half a bit more per character. Adding two characters of length usually gains more than that, and length never runs into a site that rejects certain punctuation or a system that mangles it. Include symbols where they are allowed, but reach for length first.
Look-alike characters
The No look-alike characters option removes I l 1 |, O 0 and a few others that are hard to tell apart in many fonts. It costs a little entropy and is worth it only when a password will be read off a screen and typed by hand, or dictated. For anything living in a password manager, leave it off.
Passphrases
Four or five genuinely random words carry entropy comparable to a shorter random string while being far easier to type on a phone or read aloud. Random characters are the better choice where a password is stored in a manager and never typed, which covers most accounts. Neither is universally right, and the deciding question is usually whether a human has to reproduce it.
Reuse is the real risk
The strongest password on this page is worth very little if it is used on more than one site. Breaches happen to services you cannot control, and a reused password turns one breach into several. A unique password per account matters more than the length of any of them, which in practice means using a password manager.
Questions
Is it safe to generate a password on a website?
Only if it is generated in your own browser and never sent anywhere, which is the case here: there is no backend, no request is made when you press generate, and nothing is stored. A generator that produces passwords on a server is a different proposition entirely, because the server has seen your password.
What does entropy in bits mean?
It measures how many equally likely passwords your settings could have produced, expressed as a power of two. Each extra bit doubles the number of guesses an attacker needs. Around 70 bits is comfortable for an ordinary account and 100 or more for anything protecting other secrets, such as a password manager master key.
Are random characters better than a passphrase?
Not necessarily. Four or five genuinely random words carry similar entropy to a shorter random string and are far easier to type and remember. Random characters win where a password is stored in a manager and never typed by hand, which is most of them.
Should I include symbols?
They add roughly half a bit per character over letters and digits alone, which is real but small. Adding two more characters of length usually gains more, and length never breaks a site that rejects certain punctuation. Include symbols where the site allows them and reach for length first.
Why does the tool avoid Math.random?
Because it is not a cryptographic generator. Its output is predictable from previous values, so a password built with it is far weaker than its length suggests. Every value here comes from crypto.getRandomValues, and the modulo bias is discarded rather than folded in, so every character is genuinely uniform.
Related tools
Browse all Sigma Wire tools - every free tool on the site, grouped by category.