Random Password Generator

What it does

The Password Generator builds random passwords between 6 and 64 characters from the character classes you enable: uppercase, lowercase, digits and 26 symbols, for a pool of up to 88 characters. Each character is chosen with crypto.getRandomValues, the browser's cryptographically secure random number generator, and everything happens locally: the password is never sent to a server and the short history of your last five results lives only in the open page.

Technical background

Password strength is best measured as entropy: the number of bits an attacker must search when they know exactly how the password was generated. For a uniformly random password the formula is length × log2(charset size). A 12-character password using only lowercase letters gives 12 × 4.70 ≈ 56 bits; 16 characters from this tool's full 88-character pool gives 16 × 6.46 ≈ 103 bits. Each bit doubles the work, so length dominates: adding four characters to a lowercase password adds about 19 bits, while switching from lowercase to the full pool on the same length adds 1.76 bits per character. Entropy applies only to truly random output; a human-chosen P@ssw0rd2026 has far less than its length suggests.

Randomness quality is therefore essential. This generator fills a Uint32Array with crypto.getRandomValues, which the Web Crypto specification requires to come from a cryptographically secure source seeded by the operating system, and maps each value onto the selected pool with a modulo operation. With 32-bit values and a pool of at most 88 symbols, the resulting bias is below one part in forty million per character, negligible for practical purposes. Never use Math.random for secrets; it is a fast but predictable PRNG.

NIST SP 800-63B, finalized as Revision 4 in 2025, reshaped password policy around evidence. Verifiers should prioritize length (at least 15 characters when a password is the only authentication factor, 8 when used with MFA) and accept at least 64 characters; must not impose composition rules such as one uppercase plus one symbol; must not force periodic expiration, only a change when compromise is suspected; and must screen new passwords against blocklists of breached, common and context-specific values. Long random strings generated here satisfy those rules easily, and a password manager removes the memorization burden.

When a password must be typed or remembered, such as a manager's master password or a disk encryption passphrase, a passphrase of randomly selected words is the better format. With a 7,776-word diceware list each word adds log2(7776) ≈ 12.9 bits, so six words reach about 77 bits and seven about 90, while remaining easy to type on a phone. Whatever the format, the strongest password still fails if phished, so pair important accounts with phishing-resistant MFA such as passkeys or FIDO2 security keys.

Common errors and how to fix them

Problem A website rejects the generated password because of a symbol.

Fix Some legacy systems block characters such as < > ; or quotes. Disable symbols and increase length by four to six characters to keep the same or higher entropy.

Problem Short passwords that look complex.

Fix An 8-character password from all 88 symbols has only about 52 bits of entropy, within reach of GPU cracking if a fast hash leaks. Use 16 or more characters for accounts and 20+ for service credentials.

Problem Forcing users to rotate passwords every 90 days.

Fix NIST SP 800-63B advises against periodic rotation because it drives predictable increments (Password1, Password2). Require a change only on evidence of compromise and check new passwords against breach blocklists.

Problem Reusing one strong generated password across several sites.

Fix Strength does not help if another site leaks it in plaintext or with a fast hash. Generate a unique password per service and store them in a password manager.

Problem Copying the password into a chat, ticket or spreadsheet.

Fix Store it directly in a password manager or secrets vault, and share credentials through the vault's sharing feature or a one-time secret link. Rotate any password that was posted in plaintext.

Do it from the command line

# 24 random bytes as Base64 (about 32 characters, 192 bits)
openssl rand -base64 24
# 20 alphanumeric characters from the kernel CSPRNG
LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 20; echo

# PowerShell: 18 bytes from the system CSPRNG, Base64-encoded
$b = New-Object byte[] 18; [Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($b); [Convert]::ToBase64String($b)
# OpenSSL from Git for Windows works too
openssl rand -base64 24

# Fully random 20-character password
pwgen -s 20 1
# Same without extra packages
tr -dc 'A-Za-z0-9!@#%^*_+=' < /dev/urandom | head -c 20; echo
# Six-word passphrase from a local wordlist
shuf --random-source=/dev/urandom -n 6 /usr/share/dict/words | tr '\n' '-'; echo

More questions about Password Generator