Random Password Generator

The Random Password Generator makes one password at a time from the character classes you tick: lowercase letters, uppercase letters, digits and a set of 29 symbols. Set the length anywhere from 1 to 100, press Generate Password, and the result shows on a card colored by its strength rating with a copy button. Everything runs in your browser; nothing you generate is sent anywhere.

Options

• Length: 1 to 100 characters. The default is 8, which is the floor most sites accept; 16 is a better habit.
• Lowercase (a–z), uppercase (A–Z), numbers (0–9): tick any combination. At least one box always stays ticked, so you cannot end up with an empty character set.
• Special characters: adds these 29 symbols to the pool: !@#$%^&*()_+~`|}{[]:;?><,./-=. Untick it for sites that reject symbols, or when the password will be typed on a phone.

Each position is drawn independently from the combined pool, which is how a properly random password should work. It also means a class you ticked is not guaranteed to appear in a short password: a 6-character password with all four boxes ticked will occasionally come out without a digit. If a site insists on "at least one of each", generate again or go longer; at 12 or more characters every class almost always shows up.

The strength label

The rating shown under the options and on the result card is based on length alone: 4 or fewer characters is Very Weak, 5 to 7 is Weak, 8 to 11 is Good, 12 to 15 is Strong, and 16 or more is Very Strong. It does not change when you untick character classes, so treat it as a rule of thumb rather than a measurement. For a rough sense of the real numbers: with all four classes ticked, the pool is 91 characters, so each character adds about 6.5 bits. An 8-character password is around 52 bits, 12 characters is around 78 bits, and 16 characters is around 104 bits, which is beyond any practical brute-force attack. Lowercase only is 26 characters, about 4.7 bits each, so you need roughly 40 percent more length for the same strength.

When to use which setting

• Everything ticked, 16 to 24 characters: anything stored in a password manager. You never type it, so symbols cost nothing.
• Letters and numbers only, 14 to 20 characters: Wi-Fi keys, TV apps and consoles, anywhere you enter it with a remote or an on-screen keyboard.
• Uppercase and numbers, 8 to 12 characters: codes read over the phone, where lowercase l and uppercase I get confused. Or use the Pronounceable Password Generator, which is built for saying passwords out loud.
• Digits only, 6 characters: a one-off PIN or a test OTP for a demo.
• Long and letters only: if you need to remember it, the Memorable Password Generator gives a word-based password that is easier to hold in your head than a random string.

A note on randomness

The generator uses JavaScript's Math.random, which is fast and fine for everyday accounts, test data and placeholder credentials, but it is not a cryptographic random source. For master passwords, encryption keys, recovery codes or anything guarding money, generate the secret inside a password manager or with a tool that uses the Web Crypto API. To see how a generated password looks once a system hashes it, paste it into the SHA256 Hash Generator; hashing is one-way, which is why sites store hashes rather than the passwords themselves. Related utilities are listed under all developer & test data tools.