Password Generator
Create strong random passwords with letters, numbers, and symbols.
Written by Anil Gautam · Updated
Which characters can appear in a generated password?
All four sets are ticked by default. Uppercase has 24 letters because I and O are left out, lowercase has 25 because l is left out, numbers are the digits 2 to 9, and symbols are 13 characters: @#$%^&*_-+=? and the exclamation mark. Dropping 0, 1, I, O and l avoids the usual mix-ups when you read a password aloud or type it from a printout. With every box ticked the pool holds 70 characters, and if you untick all four the tool falls back to lowercase letters.
Every character is drawn separately from the pool using the browser's crypto.getRandomValues, so each position can be any of the 70 characters. That gives log2(70), about 6.13 bits per character: 49 bits at the minimum length of 8, 98 bits at the default 16 and about 123 bits at 20. Moving the length slider or changing a box makes a new password straight away, so copy it only after your settings are final.
Why is there no number or symbol in my password?
The generator does not force one character from each set. With 8 digits in a pool of 70, a 16-character password has a (62/70) to the power of 16 chance, about 14%, of containing no digit, and roughly 18% of 16-character passwords miss at least one of the four sets. If a site insists on a digit or a symbol, click Generate new until one appears; throwing away a few results this way costs almost nothing in strength.
Some sites reject certain symbols. If yours does, untick symbols and add length instead. Without symbols the pool is 57 characters, about 5.83 bits each, so 17 characters give roughly 99 bits, a little more than 16 characters with symbols.
How does a generated password score in the strength checker?
The Password Strength Checker assumes full alphabets of 26 + 26 + 10 + 32 = 94 characters, so a 16-character password from here that contains all four kinds shows about 105 bits there, slightly above the 98 bits the 70-character pool provides. At the checker's assumed rate of 10 billion guesses a second, working through every 98-bit combination would take about a trillion years. Keep the password in a password manager, since a random 16-character string is hard to remember, and use a different one for each site so a leak at one cannot open the others.