Random Password Generator

What a random password generator actually does

This page picks characters at random and strings them together, using crypto.getRandomValues(), the browser API meant for cryptographic use, rather than Math.random(), which is fast but predictable and was never meant to keep a secret. The password is built on your device and never sent anywhere.

The reason to hand the job to a machine is that people are bad at being random. Left to ourselves we produce a word, a capital at the front, a digit and an exclamation mark at the end, and attackers know that shape. They do not try every combination in order; they run leaked password lists and common patterns first. Swapping an a for an @ does not help, because cracking tools have tried that substitution for decades.

The number under the output is entropy in bits: the length multiplied by the base-2 logarithm of how many characters the generator was choosing from. Sixteen characters drawn from all 94 printable ASCII characters is 16 × log2(94), about 105 bits. With every box here ticked the set is 88 characters, so 16 characters is about 103 bits; excluding look-alikes trims the set to 81 and the result to about 101 bits. Length matters more than variety: 20 random lowercase letters is about 94 bits, while 8 characters using every class is only about 52. Above 90 bits is beyond brute force; below 40 is guessable.

Which length and character set for which account

• Email: 20 characters, every box ticked. Your inbox resets the password on everything else, so it deserves your strongest secret plus two-factor authentication.
• Banking and payments: 16 to 20 characters with letters, digits and symbols. Many banks still cap the length or limit which symbols they take, so generate at the longest length the form actually accepts.
• Your password manager master password: not a random string at all, but a passphrase of five or six random words. This is one of the two or three secrets you have to type from memory.
• Wi-Fi: 20 or more characters, letters and digits only, look-alikes excluded. Symbols are painful on a smart TV or console, and 20 letters and digits is already about 119 bits.
• Game accounts: 16 characters, letters and digits. Console keyboards make symbols slow and some launchers still reject them, so buy the strength back with length.
• Forums, shops and one-off signups: the default 16 with everything on. These get breached most often, so what matters is that the password is unique, not that it is enormous.
• Anything read aloud or typed by hand: keep exclude look-alikes ticked so nobody has to guess between a capital O and a zero.

How to generate a password and store it properly

1. Set the length slider: 16 to start, 20 for an account that matters.
2. Leave all four character boxes ticked. Untick symbols only if you already know the site refuses them.
3. Check the strength line. Aim for Strong or Excellent, which is 60 bits and up.
4. Press Copy, paste it into the site and into a new entry in your password manager, and save the manager entry before you submit the form so a failed signup does not lose it.
5. Turn on two-factor authentication while you are already in the security settings.

The password manager is the part people skip and the part that makes the rest work: unique random passwords are only realistic if something else remembers them. Any well-known manager is fine, including the one built into your browser or phone.

How to make a Wi-Fi password

1. Set the length to 24 and untick symbols, leaving letters and digits with look-alikes excluded. WPA2 and WPA3 personal keys take 8 to 63 printable characters, so 24 is well inside the limit.
2. Copy it into your router admin page, under the wireless security or Wi-Fi settings.
3. Save it in your password manager under the network name before you apply the change, because applying it disconnects you.
4. Reconnect each device once. The printer and the console are why the symbols are off.
5. For visitors, generate a second password for the guest network and hand it over as a Wi-Fi QR code that phones scan to join.

Getting it into the field, and clearing the clipboard after

The best move is not to use the clipboard at all: let your password manager fill the field through its extension or system autofill, so the secret never sits where other apps can read it. When you do need to copy:

• iPhone and iPad: press and hold in the field and tap Paste. iOS asks permission the first time an app reads another app’s clipboard. With Handoff on, the clipboard also reaches your Mac, so copy something harmless afterwards.
• Android: press and hold and choose Paste. Gboard keeps a clipboard history and drops unpinned clips after about an hour; open the clipboard icon on the keyboard toolbar to delete the entry sooner.
• Windows: Ctrl+V. If clipboard history is on, Win+V lists everything you copied, with a Clear all button.
• Mac: Cmd+V. The clipboard holds one item, so copying anything else overwrites it. Universal Clipboard shares it with nearby devices on the same Apple account.
• Everywhere: never move a password between devices through chat, email, a note or a ticket. Use the manager’s sync or sharing feature.

When a site rejects a perfectly good password

NIST SP 800-63B tells services to allow passwords of at least 64 characters, to accept every printable ASCII character including the space, not to impose composition rules, and to allow pasting. Sites that ignore it fail in recognizable ways:

• A maximum length of 12, 16 or 20: regenerate at the allowed length. The dangerous version is silent truncation, where the form takes 30 characters and stores 20. If a password you just set will not log you in, try its first 16 or 20 characters.
• Only certain symbols allowed: untick symbols here and add four characters of length instead. You end up stronger than the restricted set would have been.
• No spaces: the usual reason a passphrase fails. Join the words with hyphens.
• Pasting disabled: use the manager extension’s autofill, which does not go through the clipboard. Failing that, generate something shorter you can type accurately rather than reusing an old password.
• Case-insensitive logins: rare and undocumented. If a password works with the wrong capitalization, treat that account as low security and lean on two-factor authentication.
• Security questions: answer them with generated strings kept in your manager, not with facts about you. A mother’s maiden name is public information.

Limits, privacy and honest caveats

What leaves your browser: nothing. The password is generated locally by crypto.getRandomValues() and is never transmitted, stored or logged. That also means nobody can recover it for you, so save it before you close the tab.

Entropy is a ceiling, not a promise. The bits describe the generator, not your habits. A 105-bit password reused on three sites is worth as much as the weakest of the three, and no amount of entropy survives typing it into a phishing page. Uniqueness and a second factor do more for you than extra length past 20 characters.

A note on the mathematics. Each character comes from a 32-bit random value reduced modulo the size of the character set. Because 2^32 is not an exact multiple of 81 or 88, a few characters are very slightly more likely than the rest. The deviation is around one part in a hundred million and has no practical effect, but it is the sort of detail worth knowing about any generator you rely on.

Rotate on evidence, not on a calendar. NIST advises against forced periodic changes and recommends that services check new passwords against lists of breached and commonly used values. A freshly generated random string will not be on such a list; one you invented yourself might be. Change a password when a service reports a breach or when you have shared it, not every 90 days.