PFVPFV Tools
All tools

Password Generator

Strong, random passwords with configurable length, charset, and entropy estimate.

  • password
  • random
  • secure
  • entropy

About Password Generator

The single best thing you can do for an account's security is use a long, random password unique to that account and store it in a password manager. Human-chosen passwords are predictable in ways modern attackers exploit at scale, but a string of 20 random characters is computationally infeasible to guess — even by an attacker with a fast graphics card and a leaked password list.

This generator uses your browser's crypto.getRandomValues — the same source of randomness that secures TLS keys — to produce cryptographically random passwords. It also estimates the entropy in bits, which is the standard way to compare password strength: every extra bit doubles the work an attacker has to do, and anything above ~80 bits is generally considered very strong.

How to use

Use the length slider to pick a target password length — 20 characters is a sensible default; longer is always stronger. Use the "How many" slider to generate up to 50 at once, useful if you want to pick one you can read aloud easily.

Tick or untick the character-class boxes (a–z, A–Z, 0–9, symbols) to control which character pools the password draws from. Tick "Exclude ambiguous" to drop O, 0, l, I, and 1 — useful when the password might be transcribed by hand or read off a screen. Each generated password has a copy button, and the strength badge beside the Generate button shows the entropy estimate in bits. Everything happens locally; nothing is logged or sent over the network.

Frequently asked questions

  • How long should my password be?

    Longer is always better. With a full character set, 12 characters is the minimum widely considered "strong" today, 16 is comfortable, and 20+ is overkill for any practical attacker. Length matters more than character variety — a 20-character password drawn from just letters and digits is harder to crack than an 8-character one with every punctuation mark.

  • What does entropy in bits mean?

    Entropy is a measure of password unpredictability — each extra bit doubles the average number of guesses an attacker needs. Under 40 bits is weak; 40–60 fair; 60–80 strong; above 80 very strong. A 20-character password drawn from a 90-character alphabet has roughly 130 bits of entropy, which is computationally infeasible to brute force even with massive resources.

  • Where is the randomness from?

    The browser's crypto.getRandomValues — a cryptographically secure random source, the same kind that backs TLS keys and the WebCrypto API. The generator also rejects values that would bias the modulo selection so every character in the password is uniformly distributed across the allowed alphabet.

  • Are generated passwords ever sent or stored?

    No. Generation happens entirely in your browser; nothing is sent to a server, stored in local storage, or kept after the page is closed. The strongest password manager is one that never sees the network — paste the result straight into a manager like 1Password, Bitwarden, or your browser's built-in keychain.

  • When should I tick "Exclude ambiguous"?

    When the password will be read off a screen, written down, or transcribed across a phone call — characters like O/0 and l/I/1 cause copy errors. For passwords that stay in a manager and get pasted in, leave it off so the alphabet stays as large as possible.

More Generators tools