Password generator

How it works

1. Set the length. Twenty characters is a good default for anything stored in a password manager; sixteen is plenty for most accounts.
2. Choose the character sets. Turn symbols off for a site that rejects them, and turn on “Leave out look-alikes” for a password somebody has to read off a screen or a printout.
3. New passwords are drawn as you change any setting — there is nothing to wait for.
4. Copy the one you want, and store it in a password manager rather than in a document.

Frequently asked questions

Is the password sent anywhere?

No, and this is the one tool where that question deserves a blunt answer: a password generated on a server is a password that existed somewhere other than your machine. These are drawn in your browser, are never transmitted, and are gone when you close the page.

Where does the randomness come from?

From crypto.getRandomValues, the browser's cryptographic generator, which is seeded by the operating system. It is not Math.random, which is predictable from a handful of outputs and has no business generating a password. The characters are also drawn without modulo bias: values that would favour the first few characters of the alphabet are discarded and drawn again.

How long should a password be?

Long enough that guessing it is hopeless, which today means about 12 characters minimum and 16 to 20 comfortably. The strength shown next to the length is the number of bits — 80 bits is strong, 100 bits is beyond any foreseeable attack. Length buys far more than exotic characters: a 20-character password of lower-case letters alone is stronger than a 10-character one using everything.

What are look-alike characters?

Capital I, lower-case l and the digit 1; capital O and zero; B and 8; S and 5; Z and 2. They cause no trouble when a password is copied and pasted, and endless trouble when it is read aloud, typed from a printout or entered on a TV remote. The option leaves them out at a small cost in strength, which the bits figure accounts for.

Are the same passwords generated for everyone?

No. Each draw is independent and comes from your device's own generator. The list also changes every time you touch a setting, so nothing you see was ever shown to anyone else.