How are passwords generated?
With the browser’s crypto random generator. The default is 16 characters using upper case, lower case, and numbers. Symbols are optional.
Create strong, secure passwords for your accounts
oqaeMZIqS0sZ82NkInclude
Strong · about 95 bits from 16 characters drawn from 62 symbols.
Extra length. Still only as safe as where you store it. This is an estimate from length and character variety, not a check against leaked passwords.
Runs in your browser. No signup required.
Each password is a random string from the character sets you leave on. Uppercase is A–Z, lowercase is a–z, numbers are 0–9, and symbols are the punctuation set on the page. The default is 16 characters with uppercase, lowercase, and numbers. Symbols start off because some forms reject them. If every set is off, the generator uses lowercase so it still has a pool, and the page says so.
Randomness comes from crypto.getRandomValues. If that API is missing, the page does not switch to a weaker generator. It tells you a password could not be created. Values are drawn with rejection sampling so the modulo bias of a plain remainder is avoided.
Use it when you need a new login and you will store the result in a password manager. The strength line is an entropy estimate: length times the log of the pool size, in bits. It is not a search of leaked passwords, and it does not know a site’s rules. A short string can look random and still be weak. A long one is only as safe as the place you paste it. This page does not remember the previous password when you regenerate.
Length 16 with uppercase, lowercase, and numbers draws from 62 characters. That is about 95 bits, which this page labels strong. Length 8 with only lowercase is about 38 bits and is labeled weak. If a site rejects symbols, leave them off and add length instead of retrying until a symbol happens to be accepted.
Related on UtilGenie: Hash Generator, UUID Generator.
Follow along with the steps below.
Set a length from 6 to 64. The default is 16.
Turn uppercase, lowercase, numbers, and symbols on or off. If every set is off, lowercase is used.
Read the strength note. It estimates entropy from the length and the character set. It is not a breach check.
Copy the password into a password manager. Regenerate replaces it, and the old one is not stored.
With the browser’s crypto random generator. The default is 16 characters using upper case, lower case, and numbers. Symbols are optional.
No. A password is created on this page and is not saved to an account. Copy it into your password manager.
The generator falls back to lowercase letters so it still has a character set to draw from.
No. This builds a random character string. It does not offer dictionary-word passphrases.
Yes. Generate again to replace the current password. The previous one is not stored here.
It estimates entropy from the length and the size of the character set you turned on. It does not check leaked-password lists, and it does not know a website’s rules. A long random password is only as safe as the place you store it.
Symbols raise the pool size, which raises the estimate. Some sign-up forms reject characters such as brackets or punctuation. Turn symbols off if a site will not accept them, and add length instead.
The page does not fall back to a weaker random source. It tells you the password could not be generated. Use a current browser that exposes crypto.getRandomValues.
Advertisement