Password Generator

Minimum 16 characters for any account you care about. For email and banking: 20+ characters. For root server credentials or encryption keys: 24-32 characters. The relationship between length and security is not linear — each extra character multiplies the search space. A 20-character alphanumeric password (62^20) is over 14 billion times harder to brute-force than a 16-character one (62^16). At 16 characters with all character types enabled, the entropy is approximately 100 bits — computationally infeasible to crack with any foreseeable technology.

Entropy measures how unpredictable a password is, in bits. Higher entropy = harder to guess. It is calculated as log2(character_pool_size) × password_length. Using all four character types (uppercase + lowercase + numbers + symbols) gives you a pool of approximately 94 characters — log2(94) ≈ 6.55 bits per character. A 16-character password with all types: 16 × 6.55 ≈ 105 bits of entropy. For reference, 80 bits is considered strong, 100+ bits is very strong for current technology. The strength indicator in the tool shows this visually.

Use all four types (uppercase, lowercase, numbers, symbols) whenever the site or system allows it — this maximizes entropy per character. Some systems restrict characters: Linux system passwords accept all types. Many websites reject certain symbols (especially <, >, ", ', \, &) because they conflict with HTML or query syntax. Windows passwords accept most symbols. Database passwords sometimes need quoting if they contain special characters used by connection string parsers. If a site rejects your password, try the alphanumeric preset (uppercase + lowercase + numbers) as a fallback.

Characters like lowercase l, uppercase I, and digit 1 are visually identical in many fonts (serif, monospace, some sans-serif). Similarly, uppercase O and digit 0 are often confused. This matters when you must type the password by hand (mobile device login, system recovery console, a device where you cannot paste). Excluding these characters means every character is visually unambiguous. The entropy cost is minimal: you go from 94 characters to roughly 86, losing less than 0.13 bits per character — well worth the usability improvement.

Random character passwords (like this tool generates) pack more entropy per character but are hard to memorize. Passphrases (four or more random words: "correct-horse-battery-staple") are more memorable but longer. A 6-word passphrase from a 7776-word list (diceware) provides about 77 bits of entropy — comparable to a 12-character random password. For accounts where you must memorize the password (master password manager password, device login), a passphrase is often the better choice. For everything else that lives in your password manager, a 20-character random password is superior.

If a site limits passwords to 8-12 characters, that is a security red flag — major breach victim data shows these sites often store passwords insecurely. Use the maximum length they allow, with all character types they permit. If they reject symbols, use alphanumeric only and compensate with length. Never reuse passwords across sites regardless of their quality, since a breach at one exposes your other accounts. Store everything in a password manager (Bitwarden is free and open-source; 1Password and KeePass are good alternatives).

No. All generation happens in your browser's memory. The in-page history list is session-only — close or refresh the tab and it is gone. Nothing is sent to any server, saved to localStorage, or logged anywhere. You can verify this by opening browser DevTools and checking the Network tab — you will see zero requests when clicking Generate.