How to use the password generator

  1. Choose a length with the slider, from 4 to 128 characters.
  2. Choose which character sets to include: uppercase, lowercase, digits, and symbols.
  3. Tick Exclude look-alikes to avoid characters that are easy to confuse, such as I, l, 1, O, and 0. This helps when a password has to be read aloud or typed from paper.
  4. Choose how many passwords to generate and click Generate. Click Copy next to the one you want.

Each password includes at least one character from every set you selected.

How the passwords are generated

Passwords are created in your browser with the Web Crypto API (crypto.getRandomValues), the same cryptographically secure random number source browsers use for encryption. Characters are chosen with rejection sampling, so every character in the pool is equally likely, and the final order is shuffled with an unbiased Fisher–Yates shuffle.

Passwords are never sent to a server or stored. When you close or reload the page, they are gone.

How strong is strong enough?

The strength meter estimates entropy in bits: length × log₂(number of possible characters). Each extra bit doubles the number of guesses an attacker needs.

  • Below 40 bits: weak. Can be guessed quickly if a password hash leaks.
  • 40–59 bits: fair. Acceptable only where login attempts are limited.
  • 60–79 bits: strong. Good for most online accounts.
  • 80 bits or more: very strong. Use for password managers, email, and encryption keys.

A 16-character password using all four sets has about 104 bits of entropy. Length matters more than complexity: adding four characters adds more strength than adding symbols to a short password.

Good password habits

  • Use a different password for every account. When one site is breached, attackers try the same email and password everywhere else.
  • Use a password manager to store generated passwords, so you only need to remember one strong master password.
  • Turn on two-factor authentication for email, banking, and work accounts. It protects you even if a password is stolen.
  • For passwords you must remember, a passphrase of five or more random words is easier to type and can be just as strong.
  • Respect site rules. Some sites limit length or reject certain symbols. Untick Symbols or lower the length if a site refuses the password.

Frequently asked questions

Can QuickToolsBox see the passwords I generate?

No. Generation happens in your browser and nothing is transmitted.

Is Math.random() used?

No. Math.random() is not designed for security. This tool uses crypto.getRandomValues() only.