Password generator.

How this password generator works

• Real randomness: every character comes from crypto.getRandomValues, the browser’s cryptographic generator, never Math.random.
• No bias: picking a character with random % pool size slightly favours the first characters of the pool. This tool uses rejection sampling instead: it throws away the few random values that would cause the skew, so every character in the pool is exactly equally likely.
• Every ticked type is included: if you tick uppercase, lowercase, numbers and symbols, each password contains at least one of each. It does that by drawing again until all types appear, so the result is still uniform over every valid password.
• Entropy in bits: the figure under each password is the exact number of bits for your settings (the base-2 log of how many valid passwords exist). Each extra character from the full 90-character set adds about 6.5 bits, and every extra bit doubles the guesses needed. For more on how to read it, use the password entropy calculator. The Weak / Good / Strong / Very strong label is TNAADO’s own rule of thumb (Good from 60 bits, Strong from 80, Very strong from 100), not an official category.
• Private: no network request is made when you generate, and nothing is written to cookies, local storage or logs. Close the tab and it is gone. Copy it into a password manager before you leave.

Length matters more than complexity

NIST’s current guidance for services that handle passwords, SP 800-63B-4, says a password used as the only factor must be at least 15 characters, a password used only as part of multi-factor authentication at least 8, and that services should accept at least 64 characters. It also says services must not impose other composition rules, such as requiring a mix of character types. The default here is 16 characters, which clears the 15-character floor. The character-type boxes are there because plenty of sites still demand them.

Want something you can type from memory or read out loud? Use the Diceware passphrase generator for a random word-based passphrase. Need exactly 16 characters? Try the 16-character password generator. For a numeric code, see the random PIN generator, and for a router, the Wi-Fi password generator.

Sources (retrieved 2026-10)

• NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management: password length minimums (15 and 8), at least 64 characters accepted, no other composition rules, password managers and paste allowed.

FAQ

How long should a password be?

NIST SP 800-63B-4 requires services to demand at least 15 characters when a password is the only factor, and at least 8 when it is only part of multi-factor sign-in. This generator defaults to 16 and goes up to 128. Longer is better, and a password manager removes any need to remember it.

Do I need numbers and symbols in a password?

Not for security reasons alone: NIST says services should not impose composition rules and that length is what to encourage. But many sites still require a mix, so you can tick or untick each type. Any type you tick is guaranteed to appear at least once.

Is this password generator safe to use?

The password is generated on your device with crypto.getRandomValues, no network request is made, and nothing is stored. The usual caveats apply to your own device: clipboard managers, browser extensions and screen sharing can see what you see, so copy it straight into your password manager.

What does the entropy figure mean?

It is the number of bits of uncertainty in a randomly generated password, the base-2 log of how many different passwords your settings could have produced. Each extra bit doubles the number of guesses an attacker needs. It only applies to random passwords like these, not to ones you invented yourself. See the password entropy calculator.

Why exclude 0, O, 1, l and I?

They look alike in many fonts, which causes typing mistakes when you have to read a password and enter it by hand. Excluding them shrinks the character set slightly, and the entropy figure updates to match.

Is there a passphrase mode?

Passphrases have their own tool: the Diceware passphrase generator picks random words instead of characters, so the result is easier to type and say aloud.

Should I use a password manager?

Yes, if you can. NIST requires services to allow password managers and autofill, and says they should permit pasting, precisely so that people can use long random passwords like these without memorising them.