About Secure Password Generator
Secure Password Generator draws passwords character by character from the classes you enable, using the browser's cryptographic random source, and produces up to 100 candidates at a time. Length runs from 4 to 256, with 20 as the default.
A password's strength is the size of the space it was drawn from, not how complicated it looks. Tr0ub4dor&3 looks complex and is weak, because a human chose the pattern and every cracking rule set knows that pattern. Twenty characters drawn uniformly from an alphabet of 80 is about 126 bits whether or not it looks random, so generation and length are the only levers worth pulling.
How to use this developer tool
- Set the length. Twenty is the default; go longer whenever a password manager will do the typing.
- Enable the character classes the receiving service accepts. Turning one off shrinks the alphabet and the entropy per character.
- Leave exclude ambiguous on whenever a human must read the value off a screen; it removes O, 0, I, l, 1, and the pipe.
- Choose how many candidates you want, from 1 to 100, and generate.
- Copy one straight into the password manager field that will hold it, then clear the pane; the list stays in the page until you do.
Worked example: the default settings, spelled out
With all four classes enabled and ambiguous characters excluded, the pool is exactly 80 characters, and every position is an independent uniform draw from it.
Length 20
Uppercase on
Lowercase on
Digits on
Symbols on
Exclude ambiguous onABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789!@#$%^&*()-_=+[]{};:,.?
W$m-t%4{6uX#!yRDX[reEighty characters is about 6.32 bits each, so twenty of them is roughly 126 bits. Note what uniform sampling does not promise: a candidate may contain no digit at all, purely by chance. That fails a form demanding one of each class, and the fix is to generate another.
Entropy by alphabet and length
Bits of entropy for a value drawn uniformly at random; a human-chosen password of the same shape is worth far less. Roughly 80 bits already puts an offline attack beyond any realistic budget, and going further buys margin against a service that stored your password badly.
| Alphabet | Size | Bits per character | 12 chars | 16 chars | 20 chars |
|---|---|---|---|---|---|
| Lowercase only | 26 | 4.70 | 56 bits | 75 bits | 94 bits |
| Upper and lower | 52 | 5.70 | 68 bits | 91 bits | 114 bits |
| Alphanumeric | 62 | 5.95 | 71 bits | 95 bits | 119 bits |
| All four, ambiguous excluded | 80 | 6.32 | 76 bits | 101 bits | 126 bits |
| All four, full set | 85 | 6.41 | 77 bits | 103 bits | 128 bits |
Troubleshooting
The signup form rejects the password as not complex enough.
Why it happens Uniform sampling does not guarantee one character from every enabled class. Over twelve characters drawn from eighty, a candidate with no symbol is uncommon but possible.
Fix Generate a batch of ten and take one that satisfies the rule, or add length. Do not hand-edit a symbol in; regenerating is free and keeps the draw uniform.
The password works once and then fails on the next login.
Why it happens The field truncated it silently at a maximum length, or stripped characters it does not accept, so what the service stored is not what you pasted.
Fix Check the stated length limit before generating and reset with a shorter alphanumeric value. Silent truncation is a warning about how that service handles passwords generally.
A password read aloud or typed from a printout keeps failing.
Why it happens Capital O against zero, and capital I against lowercase L against one, are indistinguishable in most interface fonts and most handwriting.
Fix Turn on exclude ambiguous first. It costs about 1.8 bits across a 20-character password, which one extra character more than repays.
The password breaks a shell command, a YAML file, or a connection string.
Why it happens Symbols such as the dollar sign, exclamation mark, ampersand, and semicolon are special to shells, templating systems, and URL parsing.
Fix Single-quote it in shell, percent-encode it with the URL Encoder & Decoder, or drop symbols and add length: two extra alphanumeric characters more than replace what symbols contributed.
When this tool is the right choice
- Creating a unique password for a service where a password manager will store it.
- Generating a batch of distinct credentials for seeded test accounts or fixtures.
- Producing a value a colleague must read off a screen, with ambiguous characters excluded.
- Producing a random string for a non-secret purpose, such as a test tenant name.
When to use something else
- Deriving an encryption key. Use the key derivation function your protocol specifies — PBKDF2, scrypt, Argon2, or HKDF — or the platform's key API.
- Choosing the one master password you type from memory. A random 20-character string is not memorable; a passphrase of equivalent entropy is.
- Server-side password storage. This produces candidates, not verifiers; for Basic Authentication the htpasswd Entry Generator produces the hash that goes in the file.
Privacy and data handling
Every candidate is assembled in this tab from crypto.getRandomValues, the browser's cryptographically secure random source, and nothing is transmitted or stored. The output field is marked so the browser will not offer to save it. The limits are worth stating plainly: the value is plain text you can screenshot, any extension with page access can read it, and copying puts it on your clipboard.
Related developer tools
Frequently asked questions
Is browser randomness good enough for a real password?
Yes. crypto.getRandomValues is seeded from the OS entropy pool, the same source a native tool uses. It also samples by rejection rather than modulo, so no character is even slightly more likely — modulo bias is the classic flaw in hand-rolled password code.
Should I trust any website with a password I will actually use?
Generation here runs locally and nothing is sent, but you cannot verify that from outside on any site, and pasting secrets into web pages is itself the risk. Generate the passwords you rely on inside your password manager.
How long should a password be?
If a manager stores and types it, 20 characters or more costs you nothing. If you type it yourself, length still beats symbol variety: characters buy more entropy per unit of annoyance than classes do.
Does excluding ambiguous characters weaken the password?
Marginally. The alphabet drops from 85 to 80, or 6.41 to 6.32 bits per character, about 1.8 bits across a 20-character value. One additional character more than pays that back.
Why does it produce several candidates at once?
So you can pick one that types well or satisfies a composition rule. The one you keep is still a uniform draw from the subset that met your criterion, and that subset is only negligibly smaller.
Can I reuse one generated password across low-value accounts?
No. Reuse is what turns one site's breach into a compromise of everything else, and low-value accounts are the most likely to be breached. A password manager makes uniqueness free.