Developer

Password Generator

Generate strong random passwords by length and character set.

Character types
Rule presets
Generated passwords

    Passwords are generated entirely in your browser and are never uploaded or stored.

    What is a password generator?

    The password generator builds an unpredictable random password as soon as you pick a length and the character types. Passwords people invent, such as words or birthdays, leave patterns behind, while a value drawn from a random source carries no such clues. Change any option and a fresh set appears instantly, and each line has its own copy button.

    Options explained
    • Length: 4 to 128 characters. We recommend 14 or more for everyday accounts and 16 or more for important ones.
    • Character types: every type you select is guaranteed to appear at least once.
    • Exclude look-alikes: drops 0/O and 1/l/I to prevent mistakes when writing a password down or reading it out.
    • Rule presets: apply the settings that Korean banks and government sites usually require (8 to 20 characters mixing letters, numbers and symbols) in one tap.
    Note: each site accepts a different set of symbols. If a sign-up form rejects the password, try the "No symbols allowed" preset.
    Privacy and how it works

    Everything is generated inside your browser using only the cryptographic random numbers from crypto.getRandomValues. Generated passwords are never sent to a server and are not included in this site's history or share links. A share link carries only the length and option settings.

    Strength in entropy: why length matters

    Strength is estimated as entropy (bits) = length × log2(size of the character pool). Using upper- and lowercase letters, numbers and symbols gives a pool of about 90 characters, which adds roughly 6.5 bits per character. That is about 105 bits at 16 characters and about 78 bits at 12. A 6-digit numeric code is only about 20 bits and falls quickly, so keep it for PIN use only.

    This tool labels under 40 bits as weak, under 60 as fair, under 80 as strong, and anything above as very strong. Adding two or three characters of length often raises entropy more than adding one more character type.

    Is the generated password sent to a server or stored?
    No. Passwords are created in your browser with crypto.getRandomValues and only shown on screen. They are not sent to a server, and they are not included in this site's history or share links. A share link contains only the length and option settings.
    How long should a password be to be safe?
    If you mix upper- and lowercase letters, numbers and symbols, around 14 characters is a practically safe level, and 16 or more is recommended for important accounts. Each extra character multiplies the number of possibilities by the size of the character pool, so adding length helps more than forcing in awkward symbols.
    What is entropy (bits) and how is it calculated?
    Entropy expresses how hard a password is to guess as a power of two. With N possible characters and a length of L, it is estimated as L × log2(N). For example, 16 characters drawn from 94 symbols gives about 105 bits, and above 80 bits brute force is considered practically infeasible.
    When should I exclude look-alike characters?
    When you write a password on paper or read it out over the phone, the digit 0 and letter O, or the digit 1 and the letters l and I, are easy to confuse. Turning this option on leaves them out and cuts typing mistakes. The pool gets slightly smaller, so entropy drops a little; adding one or two characters of length makes up for it.
    Can I make a password that fits Korean bank and government site rules?
    Many Korean financial and public-sector sites require 8 to 20 characters mixing letters, numbers and symbols. Tapping a preset chip applies settings that match, and each selected character type is guaranteed to appear at least once. Since the accepted symbols differ from site to site, also check the guidance on the sign-up screen.
    How do I manage passwords safely?
    The basics are a different password for every site and keeping hard-to-remember values in a trusted password manager. Turn on two-step verification where you can. Leaving a generated password in a chat app or notepad creates a leak path, so copy it, paste it straight in, and then clear your clipboard history.