Random Password Generator
Generate strong random passwords in your browser using the Web Crypto API, with an entropy figure so you can see how strong they actually are.
A password generator produces a random string from a character pool using a cryptographically secure random source. These are generated by your browser's Web Crypto API and never transmitted, and the entropy figure tells you how much guessing work the password actually costs an attacker.
Runs entirely in your browser · no signup · nothing is uploaded · updated 2026-09-02
How to use it
- 1.Set the length - 20 characters is a good default for anything important.
- 2.Choose which character sets to include.
- 3.Generate, copy the one you want, and store it in a password manager.
Entropy by length and character set
Entropy is length x log2(pool size). Length buys more strength than complexity: 20 lowercase characters beat 12 mixed ones.
| Length | Lowercase only | Upper + lower + digits | All four sets |
|---|---|---|---|
| 8 | 38 bits | 48 bits | 52 bits |
| 12 | 56 bits | 71 bits | 78 bits |
| 16 | 75 bits | 95 bits | 104 bits |
| 20 | 94 bits | 119 bits | 130 bits |
| 24 | 113 bits | 143 bits | 156 bits |
| 32 | 150 bits | 190 bits | 208 bits |
Frequently asked questions
How long should a password be?
At least 16 characters for anything that matters, and 20 or more for a password manager master key or an email account. Length beats complexity: a long lowercase password is stronger than a short one full of symbols.
Are these passwords safe to use?
They come from crypto.getRandomValues, which is a cryptographically secure source, and they are generated locally and never sent anywhere. The page also works offline once loaded, which you can verify in the network tab.
What is entropy and what number should I want?
Entropy measures how many guesses an attacker needs, in bits. Under 60 bits is weak, 80 is reasonable, and above 100 is beyond any realistic offline attack.
Should passwords contain symbols?
They help, but far less than length. Adding four characters to a lowercase-only password buys more entropy than adding one symbol to a short one.
Why are some characters missing from the pool?
Look-alikes - l, I, 1, O and 0 - are excluded, because passwords do sometimes get read aloud or copied by hand and those cause real errors.
Should I change my passwords regularly?
No. NIST dropped that advice in 2017. Forced rotation makes people pick weaker, more predictable passwords. Change one when there is a reason to.
What is a passphrase and is it better?
Several random words - correct horse battery staple. Four random words from a large list is around 50 bits, which is memorable but weaker than a 20-character random password. Use passphrases for what you must memorise and random strings for everything a manager holds.
Do I still need two-factor authentication?
Yes. A strong password does nothing against a phishing page or a database breach. Use an authenticator app or a passkey rather than SMS.
The guide behind this tool
Tools that pair with this one
DeveloperJWT Decoder
Paste a JSON Web Token to decode its header and payload and read every claim, including expiry. Runs entirely in your browser.
DeveloperJSON Formatter
Format, validate and minify JSON in your browser. Get the exact line and column of a syntax error instead of a vague parse failure.
DeveloperUUID Generator
Generate cryptographically random UUID v4s, or time-ordered UUID v7s that index far better as database primary keys.
DeveloperRegex Tester
Test a JavaScript regular expression against sample text, see every match with its position and capture groups, and get real errors for invalid patterns.
Built something?
RankCert is a weekly launch board where products rank on domain control we verify ourselves - not upvotes. Listing is free and the link is dofollow whether or not you display our badge.