Password Generator — strong passwords with the ambiguity removed
Generate passwords using the operating system random source, with look-alike characters excluded.
Free and instant — results appear in seconds. No sign-up, no limits, and nothing you type is stored.
Generated with random_int(), which draws from the operating system's cryptographic random source rather than a seeded pseudo-random generator. The distinction matters: predictable generators have produced guessable passwords in real breaches.
Ambiguous characters — 0/O, 1/l/I — are excluded, because passwords get read aloud, copied by hand, and dictated over the phone more often than anyone plans for.
Length beats complexity
Entropy measures how many guesses an attacker needs. It is roughly length × log₂(pool size).
8 chars, all four sets (pool 71) ≈ 49 bits
12 chars, all four sets (pool 71) ≈ 74 bits
16 chars, lowercase only (pool 25) ≈ 74 bits
20 chars, all four sets (pool 71) ≈ 123 bitsNote lines two and three. Twelve mixed characters and sixteen lowercase characters give the same strength. Length substitutes for complexity, and it is far easier to type and remember.
This is why the old "one uppercase, one number, one symbol" rule has been abandoned by current guidance. It produced predictable patterns — Password1! satisfies every requirement and appears in every cracking dictionary — while adding little real entropy.
Below 50 bits is weak against offline attack. Above 80 is comfortable for an account password.
Where entropy stops mattering
Against a well-implemented login form with rate limiting, almost any non-obvious password is sufficient, because the attacker gets a handful of attempts.
Entropy matters when a password database leaks and the attacker can guess offline at billions per second. That is the scenario these lengths are sized for.
Reuse is the real risk
A long unique password reused across sites is worse than a shorter unique one per site. Breaches are traded and replayed automatically — the credential-stuffing attack does not need to crack anything.
This is the argument for a password manager. The passwords it generates are strong; more importantly, they are different.
Rotation
Forced periodic rotation is no longer recommended. It pushes people toward predictable variants — Summer2024 becoming Autumn2024 — which is worse than a strong password kept until there is reason to change it.
Change a password when there is evidence of compromise, not on a calendar.
About generating passwords online
These are generated server-side and never stored, but a general principle applies to any online generator: you are trusting the operator. For high-value credentials, prefer a password manager's built-in generator, which runs locally.
Frequently asked questions
How long should a password be?
Sixteen characters or more for anything that matters. Length contributes more to strength than character variety — sixteen lowercase letters is as strong as twelve mixed-case characters with numbers and symbols, and considerably easier to type.
Do I still need uppercase, numbers and symbols?
Less than the old rules suggested. Those requirements produced predictable patterns like Password1! that satisfy every rule and appear in every cracking dictionary. Current guidance favours length over mandated composition.
Should I change passwords regularly?
Not on a schedule. Forced rotation pushes people toward predictable variants such as Summer2024 becoming Autumn2024, which is weaker than a strong password kept until there is a reason to change it. Change when there is evidence of compromise.
Is it safe to generate passwords on a website?
These are generated with a cryptographic random source and never stored, but you are trusting the operator of any online generator. For high-value credentials, use a password manager's built-in generator, which runs locally on your own device.
Reviews
No reviews yet. If this tool solved something for you, yours would be the first — and it helps other people decide whether it is worth their time.