Skip to main content
Generator Hut

Strong Password Generator

Strong random passwords with a real entropy readout.

Password settings

6–128. Length buys more than complexity does.

Character types

a–z

A–Z

0–9

!#$%&…

No 0/O, 1/l/I

Very strong128 bits of entropy

Offline attack: longer than the age of the universe

Far past any foreseeable brute-force attack.

Drawing from 85 possible characters.

Your passwords

Press Generate to create passwords.

Generate strong random passwords. Two things separate this from most password generators online: every character is drawn from your device's cryptographic random source rather than Math.random(), and the strength shown is real entropy in bits rather than a colour bar. Generation happens entirely in your browser — the page is a static file with no server behind it, so there is nothing that could log or store what you produce.

Why use this tool?

Never transmitted

The site is static with no back end. Open your network tab and watch: pressing Generate sends nothing, because there is nowhere to send it.

Real entropy, in bits

An exact measurement of how many equally likely results the generator could have produced — not a colour bar guessing at your password.

Unbiased draws

Rejection sampling rather than modulo, so no character is more likely than another. A skewed generator quietly shrinks the space an attacker must search.

All types guaranteed

Every selected character class appears, achieved by redrawing rather than by forcing characters into fixed positions — which would cost you entropy.

How this strong password generator works

Each character is drawn with crypto.getRandomValues(), which reads the operating system's entropy pool. This is the substantive difference from most generators, which use Math.random(): that function's internal state can be recovered from a modest run of prior outputs, so a password it produced is potentially reconstructable by anyone who watched enough of what the page generated earlier. For shuffling a playlist that does not matter. For a password it is the whole point.

Guaranteeing that every selected character type appears is where implementations quietly differ. The common approach places one character from each class at fixed positions and fills the rest — which reduces entropy, because those positions are no longer free choices. This tool draws a fully uniform password and simply rejects it if a class is missing, leaving the result uniform across all valid passwords. Testing across three thousand passwords found digits spread evenly across every position, with a maximum-to-minimum ratio of 1.19.

The entropy figure is the base-two logarithm of the number of possible results: character set size raised to the length. A twenty-character password using all four types draws from 85 characters, giving about 128 bits. That is not an estimate of how good the password looks — it is a count of how many the generator could have made.

How to use it

  1. Step 1: Set the length

    Twenty is a good default. Length buys far more security than complexity does, and costs nothing if a password manager types it for you.

  2. Step 2: Choose character types

    All four unless a site forbids symbols. Turn on Avoid look-alikes if you will ever read the password aloud or copy it by hand.

  3. Step 3: Generate and store

    Press Generate, select a password to copy it, and paste it straight into a password manager.

Example usage

A new account
Twenty characters, all types, copied directly into a password manager and never typed or seen again.
A password you must read aloud
Avoid look-alikes on, so nobody has to ask whether that was a one, an l or a capital I.
Bulk provisioning
Twenty passwords at once for setting up a batch of accounts or devices, each independently generated.

Frequently asked questions

Is it safe to use an online password generator?

It depends on where the generation happens. If the password is produced on the server and sent to you, it has travelled the network and existed in someone else's memory. Here it is generated in your browser by JavaScript on your device — the page is a static file with no back end. Open your browser's network tab and press Generate: nothing is sent.

How long should my password be?

Sixteen characters is a sensible floor and twenty is better. Length matters far more than complexity: a sixteen-character lowercase password beats an eight-character one using every symbol on the keyboard, and it is easier to type. If a manager fills it for you, there is no reason not to go longer.

What does the entropy figure mean?

Bits of entropy is the base-two logarithm of how many equally likely passwords the generator could have produced. Sixty bits means about a billion billion possibilities. Unlike a strength meter guessing at a password you typed, this number is exact, because the generator knows precisely how it drew.

Why do the passwords contain symbols I cannot type easily?

The symbol set avoids quotes, backslashes and backticks, which cause trouble in shells, config files and some web forms. If a site still rejects one, switch symbols off and add a few characters of length instead — the trade is roughly even.

Should I change my passwords regularly?

No, and current guidance from NIST and the NCSC agrees. Routine expiry pushes people toward small predictable changes — Summer2024 becomes Summer2025 — which is weaker than leaving a strong password alone. Change one when there is a reason: a breach, a shared device, or any suspicion it is known.

Related tools

Browse every tool in Password & Security Tools.