ToolStrong Password Generator
Create a random password of any length in one click. It is generated in your browser using secure random numbers, so it is never sent to a server.
How to generate a strong password
- Drag the length slider. Use at least 16 characters for important accounts.
- Choose which character types to include: lowercase, uppercase, digits and symbols.
- Press Generate new until you like the result, then press Copy.
- Paste it into your password manager or the sign-up form. Use a different password for every account.
How this password generator works
Each character is picked with the browser’s secure random number generator (crypto.getRandomValues), the same source used for encryption keys, not Math.random(). The tool also avoids the common bias of using a remainder, so every character in your chosen set is equally likely. It always includes at least one character from every type you switch on, then shuffles the result.
Nothing you generate leaves the page. There is no account, no log and no request to a server when you press Generate.
How long should a password be?
Length matters more than complexity. The entropy shown above is length × log₂(size of the character set), so each extra character multiplies the number of possibilities. A random 16-character password with all four types is about 103 bits; 12 characters is about 77 bits.
For accounts that matter, such as email, banking and your password manager, use 16 or more characters. Some sites cap length or reject certain symbols; if so, switch symbols off and increase the length instead.
Tips for using generated passwords
- Do not reuse a password. If one site leaks it, attackers try it everywhere else.
- Do not edit a generated password by hand to make it memorable; that makes it weaker.
- Use a password manager to remember them, and protect that one with a long passphrase and two-step verification.
- Use “No look-alikes” if you need to read the password aloud or type it from paper.
Frequently asked questions
Is this password generator safe to use?
Yes. Passwords are created in your browser with secure random numbers and are never sent to ToolShoppy or stored. You can disconnect from the internet after the page loads and it still works.
How long should my password be?
Use at least 16 characters for important accounts. Length adds more strength than extra symbols. If a site limits length, use the maximum it allows.
What does the entropy number mean?
Entropy in bits estimates how many guesses an attacker would need on average: each added bit doubles that. Above about 80 bits is considered strong against offline guessing.
Why are some characters left out with “No look-alikes”?
It removes characters that are easy to confuse when reading, such as I, l, 1, O, 0 and o, which helps when you must type a password from a printout or read it over the phone.
Can I generate a password without symbols?
Yes. Switch off the symbols chip. Increase the length to make up for the smaller character set; for example use 20 characters or more with letters and digits only.