Random Password Generator

Set a length, pick character sets, copy the result. Each character comes from your browser's crypto random source. The meter reports entropy in bits plus the time an attacker needs to guess the password from a leaked database. Nothing you generate leaves this tab.

Entropy: the number behind the meter

Strength meters on most sign-up forms guess from patterns. This one counts. A password picked at random from a pool of N characters, L characters long, holds L × log₂(N) bits of entropy. Each extra bit doubles the guesses an attacker needs.

Pool size depends on the sets you tick:

Character sets	Pool	Bits per character	16 characters	20 characters
Lowercase only	26	4.70	75.2	94.0
Lowercase + uppercase	52	5.70	91.2	114.0
Letters + digits	62	5.95	95.3	119.1
Letters + digits + 13 symbols (default)	75	6.23	99.7	124.6
All 94 printable ASCII	94	6.55	104.9	131.1

Compare the first row with the fourth. Twenty lowercase letters (94 bits) land close to sixteen characters with symbols (99.7 bits). Length buys more than symbols do. When a site rejects symbols, add four characters instead of settling for less.

With Require one from every set ticked, the true count drops a little, since strings missing a set get thrown out. The meter subtracts those strings, so the figure on screen is exact for your settings, not a rounded estimate.

How long would a guess take?

The two crack times assume the bad case: a site gets breached, its password hashes leak, an attacker runs guesses offline on GPUs. The figure shown is the average, half the search space.

Fast hash, 100 billion guesses a second. Unsalted MD5, SHA-1 or NTLM on a multi-GPU rig. Many older breaches looked like this.
bcrypt, 10,000 guesses a second. bcrypt at cost 10, or Argon2 with sane settings. A well-run site stores passwords this way today.

Sample figures for the fast-hash case:

Password	Bits	Average time to crack
8 characters, all 94 printable	52.4	8.5 hours
10 characters, letters + digits	59.5	49 days
12 characters, letters + digits	71.5	511 years
16 characters, letters + digits	95.3	7.5 billion years
20 characters, letters + digits	119.1	Longer than the universe has existed

Guessing against a live login form runs thousands of times slower because of rate limits and lockouts. Plan around the offline numbers, since a breach skips those limits.

Symbols to avoid in URLs, config files and shells

A random password ends up pasted somewhere. Some symbols cause trouble in specific places:

Where the password goes	Trouble characters	What goes wrong
Database URL, `postgres://user:pass@host/db`	`@ : / # ? %`	The URL parser reads them as separators. Percent-encode them or leave symbols off.
`.env` file or Bash double quotes	$ ` " \	`$` starts variable expansion, so part of the password silently disappears.
YAML or JSON config	`" ' \ # :`	A quote ends the string, a backslash starts an escape, `#` starts a YAML comment.
SQL string literal	`' \`	Breaks the statement unless the value goes in as a bound parameter.
Wi-Fi key on a TV or console	Look-alikes, any symbol	On-screen keyboards bury symbols two menus deep. Typos follow.

The default symbol set skips quotes, brackets and backslashes on purpose. Tick Add brackets and quotes only when the destination handles them. The default set still includes $ @ # ?, so for connection strings and .env values pick the API secret preset. The preset drops symbols and makes up for them with 40 characters, about 238 bits.

Which preset fits which job

Website login 20 characters, all four sets, 124.5 bits: Lives in a password manager, never typed by hand. Twenty characters costs nothing there.
Wi-Fi key 24 characters, letters + digits, no look-alikes, 138.7 bits: Someone types this on a phone or a smart TV. Dropping 0, O, 1, l and I ends the "is that a zero?" back and forth. WPA2 accepts 8 to 63 characters.
16-character cap 16 characters, all four sets, 99.4 bits: Banks and older portals often cap length at 16, some at 20. Sixteen random characters still sit far beyond any offline attack.
API secret 40 characters, letters + digits, 238.2 bits: Goes into environment variables, CI secrets or connection strings. No symbols means no escaping, no URL encoding, no broken deploys.

How this generator picks each character

Crypto source. Every pick calls crypto.getRandomValues, the browser API behind TLS keys and session tokens. Math.random appears nowhere on this page.
No modulo bias. Each pick draws a 32-bit number and discards any draw landing in the uneven tail above the largest multiple of the pool size. Every character in the pool gets identical odds.
Required sets without shortcuts. With Require one from every set on, the generator builds a full random string and starts over when a set is missing. Planting a forced uppercase letter at a random spot would make some patterns more likely than others.
Local only. Generation runs in this tab. Pressing New password sends no request, and the page keeps no history. To check, load the page, switch off your network, then keep generating.

Where a random password falls short

Nobody memorizes 20 random characters. Random strings belong in a password manager. For the few secrets you type from memory, such as the manager's master password or a laptop login, five or six random dictionary words are easier to recall at similar strength. This page does not build word-based passphrases.
Strength does nothing against phishing. A 128-bit password typed into a fake login page is gone. Turn on two-factor sign-in, ideally a passkey or hardware key.
Reuse cancels the gain. One password on two sites means one breach opens both. Generate a fresh one per account.
Plaintext storage cancels it too. When a site stores passwords unhashed, crack time is zero. Every figure on this page assumes hashing.
Clipboard history keeps copies. Windows clipboard history (Win+V), macOS clipboard managers and some phone keyboards save copied text. Clear the entry after pasting into your manager.

Password generator questions

Is this password generator safe to use?

Generation happens in your browser with crypto.getRandomValues. The password is never sent to Toolexe or anyone else, and the page stores nothing. Close the tab and every password on screen is gone.

How long should a password be?

Sixteen characters from letters, digits and symbols gives about 100 bits, out of reach for offline attacks on current hardware. Use 20 when a password manager stores it, since length costs nothing there. Drop below 12 only when a site forces you.

Do I need symbols in a password?

No. Symbols add about 0.3 bits per character over letters and digits. Four extra characters add about 24 bits. When a site rejects symbols, or the password goes into a URL or config file, raise the length and leave symbols off.

What does Skip look-alikes remove?

The letters i, l, o, I and O, the digits 0 and 1, plus the pipe, backtick and single quote. With the default sets the pool shrinks from 75 to 68 characters, so add a character to keep the same strength. Turn the option on for passwords someone reads off a screen or paper.

Why does another checker rate my generated password lower?

Most checkers score patterns in passwords people pick by hand, such as dictionary words and keyboard runs. This meter knows the password came from a random source, so it reports the exact size of the search space. Pattern-based checkers sometimes mark a random 12-character letters-and-digits password as weak for lacking a symbol, despite holding 71 bits.

How do I generate several passwords at once?

Set How many to 5 or 10. Each row is drawn independently and has its own copy button. Batches suit seeding test accounts or rotating credentials for several services in one sitting.