Skip to content
UtilLab

Password Generator

Generate a secure random password in one click. Customize length and character types to match any requirement.

—

16
864
Include

Passwords are generated entirely in your browser. Nothing is sent to a server.

Guide

What makes a password strong

Length beats cleverness

Password strength is measured in bits of entropy: the number of guesses an attacker needs, as a power of two. For a random password it is simply length × log₂(alphabet size). A 16-character password drawn from about 70 symbols has roughly 98 bits, far beyond what any attacker can brute-force, while a 12-character lowercase-only password has only about 56 bits.

Each extra character multiplies the work by the size of the alphabet, which is why increasing length is the cheapest way to gain strength.

How this generator works

  • Randomness comes from your browser's cryptographically secure generator (crypto.getRandomValues), not from Math.random.
  • Characters are picked with rejection sampling so no symbol is more likely than another, and at least one character from every selected set is guaranteed before the result is shuffled.
  • Look-alike characters (I, l, 1, O, 0) are left out by default so a password is easy to read or type from a screen. You can include them.
  • Nothing is sent to a server. The password exists only in your page until you close it.

Habits that matter more than the generator

  • Use a different password for every account. Reuse is how one breach becomes ten.
  • Store them in a password manager so you only need to remember one strong master passphrase.
  • Turn on two-factor authentication, preferably with an authenticator app or a security key, for email, banking and your password manager.
  • Never share passwords by chat or email, and be suspicious of any page that asks for one after a link.

Frequently Asked Questions

How does this password generator work?
The generator uses your browser's built-in cryptographic random number generator (the Web Crypto API) to select characters from the character sets you enable. This is the same source of randomness used by security-focused applications, making it far more unpredictable than Math.random(). No password is ever sent to or stored on a server.
What makes a password strong?
A strong password is long (at least 16 characters) and uses a mix of uppercase letters, lowercase letters, numbers, and symbols. Length is the most important factor — each additional character multiplies the number of possible combinations exponentially. A 20-character password mixing all character types has trillions of times more combinations than a 10-character one.
How long should my password be?
For most accounts, 16 characters is a good minimum. For highly sensitive accounts like banking or email, use 20 or more characters. If you use a password manager (recommended), password length is not a usability problem — you never need to type or remember the password yourself.
Is it safe to use an online password generator?
This generator is safe because all processing happens in your browser using the Web Crypto API — no data is transmitted anywhere. You can even disconnect from the internet before generating a password for extra peace of mind. Avoid generators that require you to submit a form or that show a loading spinner, as those may be processing passwords server-side.
Should I use a password manager?
Yes, strongly recommended. A password manager lets you generate and store a unique, strong password for every account without needing to remember any of them. This prevents the most common security mistake: reusing the same password across multiple sites. Popular options include Bitwarden (free, open source), 1Password, and KeePass.