Skip to content
Utilio

Password generator

Generate random passwords with the length and characters you need. They're created in your browser with a cryptographic generator and never leave your device.

  • Free
  • No sign-up
  • In your browser
Characters

Strength: Very strong

≈ 104 bits of entropy

Approximate value: length × log₂(possible characters).

Generated passwords

    How to use this tool

    1. Choose the length with the slider or by typing the number (between 4 and 128 characters; 16 by default).
    2. Tick the character types: lowercase, uppercase, numbers and symbols. If you'll type the password by hand, turn on “Exclude ambiguous characters”.
    3. Set how many passwords to generate at once (up to 20).
    4. Copy the one you like and save it in your password manager. Click “Generate again” if you want others.

    What makes a password strong

    A password is hard to guess when it's been chosen at random from a huge number of possible combinations. That number is usually measured in bits of entropy: each extra bit doubles the number of combinations an attacker would have to try.

    Length matters most. Adding characters multiplies the combinations far more than widening the character types: a 20-character password using only lowercase letters has more entropy (about 94 bits) than a 12-character one with lowercase, uppercase, numbers and symbols (about 78 bits).

    What doesn't add security is the appearance of complexity. “Password1!” meets many sites' rules, but it follows a very common pattern and is easy to guess. The passwords from this tool follow no pattern: every character is chosen at random.

    How entropy and strength are calculated

    The entropy shown is approximate: length × log₂(number of possible characters). With all four types turned on there are 90 possible characters, so each character adds about 6.5 bits. The tool guarantees at least one character of each ticked type, which rules out a small share of combinations and lowers the real entropy very slightly.

    The strength label uses these thresholds:

    • Weak: under 60 bits.
    • Fair: 60 to 74 bits.
    • Strong: 75 to 99 bits.
    • Very strong: 100 bits or more.

    How the passwords are generated

    Each character is chosen with crypto.getRandomValues, the browser's cryptographically secure generator. Rejection sampling is used so no character comes up more often than another, avoiding what's known as modulo bias. The characters are then shuffled with the Fisher-Yates algorithm so the required characters don't always end up in the same positions.

    Everything happens in your browser. Passwords aren't sent to any server, aren't stored and aren't recorded in analytics.

    Good practices

    A random password only protects you well if it's used properly:

    • Use a different password for every service. If one site suffers a breach, your other accounts stay safe.
    • Keep them in a password manager: you don't have to remember them, and you can use long passwords effortlessly.
    • Turn on two-factor authentication for important accounts (email, banking, social media).
    • For your password manager's master password, which you do have to memorize, a long passphrase of several random words is easier to remember than a string of symbols.

    Examples

    An email or bank account

    16 characters or more with all four character types. Save it in your password manager.

    A password you'll type by hand

    For example, the guest Wi-Fi key: turn on “Exclude ambiguous characters” to avoid mixing up uppercase I and lowercase l, or O and 0.

    A site that doesn't allow symbols

    Untick “Symbols” and make up for it with more length: 20 characters with letters and numbers exceed 100 bits of entropy.

    Frequently asked questions

    Are the generated passwords sent or stored anywhere?

    No. They're generated in your browser and aren't sent to any server or saved anywhere. If you close or reload the page, they're gone, so save the one you're going to use.

    How long should my password be?

    For important accounts, 16 characters or more is a good benchmark if you keep it in a password manager. The longer, the better: length is what increases the number of possible combinations the most.

    What are ambiguous characters?

    Characters that are easily confused depending on the font: I (uppercase i), l (lowercase L), 1, |, O (uppercase o), o and 0. Excluding them lowers entropy slightly, but avoids mistakes when typing the password by hand.

    Why do some sites reject certain symbols?

    Some services restrict the characters they accept. If a site rejects the password, untick “Symbols” and increase the length to keep it secure.

    Is a random password or a passphrase better?

    Both can be secure if they're long and chosen at random. Random passwords are ideal for storing in a password manager; a passphrase of several randomly chosen words is easier to memorize, for example for the manager's own master password.

    Related tools

    This page is also available in: Español, Português, Français