Password Generator

It uses window.crypto.getRandomValues(), the browser's cryptographically secure random number generator, which draws on randomness collected by your operating system. Rejection sampling is used so that every character in the pool is exactly equally likely.

Longer is better, and length matters more than anything else. With all four character types (an 88-character pool), each extra character adds about 6.5 bits of entropy. A 16-character password with all types has about 103 bits, which this tool labels Strong. Also follow any rules set by the site you're signing up to.

Yes — a password manager (Bitwarden, 1Password, KeePass) lets you use a unique, strong password for every account without memorizing them. Generate a random password with this tool for every account and store it in a trusted password manager.

The symbol set has 26 characters: ! @ # $ % ^ & * ( ) - _ = + [ ] { } | ; : , . < > ?. Together with 26 uppercase letters, 26 lowercase letters and 10 digits, that makes a pool of 88 characters when every type is selected.

They are a rule of thumb based on the exact entropy of your settings: under 40 bits is Weak, 40–59 Fair, 60–79 Good and 80 or more Strong. They are not an official standard. The page also shows the average time to guess the password at 10 billion guesses per second.