Password generator
Strong, random passwords made right here in your browser, so the password itself never leaves your device.
Result
What this generator does
The generator builds passwords from your browser's cryptographically secure random number generator (crypto.getRandomValues), not from Math.random(), which is predictable and unsuitable for secrets. Next to each result the page shows its entropy in bits, a measure of how hard it is to guess. Each extra bit doubles the guesses an attacker needs. The label beside it follows the bits: Weak under 40, Fair under 60, Strong under 80 and Very strong from 80.
| Mode | What you get | Entropy for the default |
|---|---|---|
| Password | 20 random characters from an 87-character pool of lowercase, uppercase, digits and symbols | About 129 bits (Very strong) |
| Passphrase | 6 words from a 1,024-word list, 10 bits per word, joined by hyphens | 60 bits (Strong) |
| PIN | 6 random digits | About 20 bits (Weak), so only for services that limit guesses |
How to use it
- Choose a typePasswords suit anything stored in a password manager. Passphrases suit the few secrets you must type or remember, like a laptop login or your password manager's master password. PINs are only for services that limit wrong guesses.
- Set the length and character classesLength matters more than variety, so raise it before you add symbols. Under More options, “Avoid look-alike characters” helps if you will read the password aloud or copy it from paper, and “How many” makes several at once.
- Copy it into a password managerUse a different one for every account, and don't email or message it to yourself.
Length, entropy and what is enough
Entropy counts the equally likely possibilities, in bits. Each added character multiplies the possibilities by the size of the pool. As a rough guide, online guessing is slow and rate-limited, so 40 to 50 bits holds up there. If a site's password database is stolen, attackers can guess offline. Fast hashes let a single graphics card try billions of guesses a second, so aim for 80 bits or more for anything important.
| Type | Entropy | Guideline |
|---|---|---|
| 8 random characters, all classes | About 51 bits (Fair) | Too short for anything important |
| 12 random characters, all classes | About 77 bits (Strong) | Reasonable for ordinary accounts |
| 16 random characters, all classes | About 103 bits (Very strong) | Strong for most uses |
| 20 random characters, all classes | About 129 bits (Very strong) | Beyond brute force |
| 6-word passphrase (1,024 words) | 60 bits (Strong) | Good for memorised secrets with a rate limit |
| 8-word passphrase | 80 bits (Very strong) | Strong even offline |
Problems and good habits
- A site rejects the password. Some sites cap the length or refuse certain symbols. Turn symbols off, or list the ones to avoid under Exclude characters, and make the password longer to compensate. The symbol set already leaves out quotes, backslashes, spaces and backticks, so passwords drop into JSON and single-quoted shell commands without escaping.
- Required character classes. Keep “Require every selected class” on so every result has at least one character from each class. The entropy figure already accounts for it.
- Typing on a phone or TV. A passphrase with a simple separator is far easier to enter than symbols.
- Reusing passwords. Even a perfect password is weak once it is reused. One unique password per site is the rule.
- Sharing one. Send one-time secrets with a tool that expires them, not in plain chat.
- Two-factor authentication. A passkey or an authenticator app protects you even if a password leaks.
How the randomness works
The generator draws unbiased random integers. It throws away values that would skew the odds, which is called rejection sampling, instead of using a modulo, which slightly favours some characters. A password is a string of characters drawn from the pool of every class you turned on. If you require every class, a draw that misses one is thrown away and drawn again, so the result is uniformly random among all valid passwords. A passphrase picks words from a fixed 1,024-word list, so each word adds exactly 10 bits. “Add a number” puts one random digit on one random word and adds a few more bits. The entropy figure is worked out from the real pool size and the require-every-class rule.
Randomness comes from the Web Crypto API, backed by the operating system's secure random generator. Official guidance is in NIST SP 800-63B, which favours length and a blocklist of breached passwords over arbitrary composition rules, and lets people use password managers.
Questions people ask
Is it safe to generate a password online?
Yes, when the password is made on your own device and sent nowhere. On this page it is. Your browser's secure random generator makes it, and it never goes to our server or to Google Analytics. Analytics does receive some settings, such as the type, length, how many and which character classes are on, but never the exclude and separator boxes. Be wary of generators that make passwords on their own server.
How long should my password be?
16 random characters is a good default, and 20 or more suits important accounts such as email, banking and your password manager's master password. Length beats complexity: every extra character multiplies an attacker's work, while a rule like “must include a symbol” adds little. If you have to remember it, use a passphrase.
Are passphrases as secure as passwords?
Not at the same length, but a long enough passphrase can match one. Six words from the 1,024-word list give 60 bits, which holds up against online guessing but is modest if a stolen password database is attacked offline. Eight words give 80 bits. Use eight words, or a long random password, for anything important.
What does “avoid look-alike characters” do?
It removes characters that are easy to confuse, such as i, l, L, I, 1, o, O and 0. The password is slightly weaker per character, because the pool is smaller, but easier to read aloud and type. The entropy shown already accounts for the smaller pool.
Can I generate many passwords at once?
Yes. Set How many under More options, up to 50 at a time. The page starts with three. It makes a new batch whenever you change a setting, or when you press Make new ones. Each one is independent and made with the same secure random source.
Why not use my own pattern, like a favourite phrase with numbers?
Predictable patterns are exactly what cracking tools try first, and their rule sets already cover the usual tricks. Swapping letters for numbers, like a for 4, or adding an exclamation mark at the end barely slows them down. Randomness is what makes a password strong.
Why does the passphrase list have only 1,024 words?
A short list keeps the page small and quick to load. Each word still adds exactly 10 bits, because it is chosen at random from all 1,024. You need a few more words than with a bigger list: six words give 60 bits here, against about 77 from the 7,776-word EFF list.
Use it from AI, the API or the command line
Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is password_generate. Please be kind to the rate limits.
curl "https://lookupowl.com/api/v1/tools/password-generator?q=20&count=1"claude mcp add --transport http lookupowl https://lookupowl.com/mcp