# Password Generator

Generate cryptographically random passwords, passphrases or PINs using crypto.getRandomValues with unbiased rejection sampling (never Math.random). Passwords: choose length 4-128, character classes, exclusions and look-alike removal; the entropy estimate accounts for the "one of each class" rule. Passphrases: 3-12 words from a 1,024-word list (10 bits each). PINs: 4-12 digits. Returns up to 50 values per call, each call fresh and uncached, plus entropy in bits and a strength label.

**Not for:** Checking the strength of a password you already have (never send real passwords to a remote tool).

- Tool id: `password-generator`
- Category: security
- Execution: pure
- MCP tool `password_generate` at https://lookupowl.com/mcp
- REST `GET https://lookupowl.com/api/v1/tools/password-generator` (or POST a JSON body)
- OpenAPI: https://lookupowl.com/api/openapi.json

## Input

| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| `mode` | "password" \| "passphrase" \| "pin" | no | `"password"` | password: random characters. passphrase: random words from a 1,024-word list (10 bits each). pin: random digits. |
| `length` | integer | no |  | Characters in a password (4-128, default 20) or digits in a PIN (4-12, default 6). Ignored for passphrases. min 4, max 128 |
| `words` | integer | no |  | Words in a passphrase (3-12, default 6). min 3, max 12 |
| `lower` | boolean | no | `true` | Password: include lowercase letters. |
| `upper` | boolean | no | `true` | Password: include uppercase letters. |
| `digits` | boolean | no | `true` | Password: include digits. |
| `symbols` | boolean | no | `true` | Password: include symbols (!@#$%^&*()-_=+[]{};:,.?/~). |
| `excludeSimilar` | boolean | no | `false` | Password: leave out look-alike characters (i l L I \| 1 o O 0). |
| `exclude` | string | no | `""` | Password: extra characters to never use. max length 64 |
| `requireEach` | boolean | no | `true` | Password: guarantee at least one character from every selected class. |
| `separator` | string | no | `"-"` | Passphrase: text between words. max length 4 |
| `capitalize` | boolean | no | `false` | Passphrase: capitalise each word. |
| `includeNumber` | boolean | no | `false` | Passphrase: add one random digit to one random word. |
| `count` | integer | no | `1` | How many to generate (1-50). min 1, max 50 |

## Output

Results are wrapped in an envelope: `tool`, `version`, `requestId`, `data`, `summary`, `meta` (cache status, timing), `permalink`. `data` has these fields:

| Field | Type | Description |
|---|---|---|
| `mode` | "password" \| "passphrase" \| "pin" |  |
| `passwords` | string[] | The generated values. Fresh and random on every call. |
| `entropyBits` | number | Entropy of the generator for each value, in bits (rounded to 0.1). |
| `strength` | "weak" \| "fair" \| "strong" \| "very-strong" |  |
| `characters` | integer | Length of each value in characters (passwords and PINs). min -9007199254740991, max 9007199254740991 |
| `poolSize` | integer | Number of distinct characters drawn from (passwords). min -9007199254740991, max 9007199254740991 |
| `wordCount` | integer | min -9007199254740991, max 9007199254740991 |
| `wordListSize` | integer | min -9007199254740991, max 9007199254740991 |
| `warnings` | string[] |  |

## Examples

### 20-character password

```json
{"mode":"password","length":20,"lower":true,"upper":true,"digits":true,"symbols":true,"excludeSimilar":false,"exclude":"","requireEach":true,"separator":"-","capitalize":false,"includeNumber":false,"count":1}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/password-generator?capitalize=false&count=1&digits=true&exclude=&excludeSimilar=false&includeNumber=false&length=20&lower=true&mode=password&requireEach=true&separator=-&symbols=true&upper=true'
```

Web page: https://lookupowl.com/password-generator?q=20

### Six-word passphrase

```json
{"mode":"passphrase","words":6,"lower":true,"upper":true,"digits":true,"symbols":true,"excludeSimilar":false,"exclude":"","requireEach":true,"separator":"-","capitalize":false,"includeNumber":false,"count":1}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/password-generator?capitalize=false&count=1&digits=true&exclude=&excludeSimilar=false&includeNumber=false&lower=true&mode=passphrase&requireEach=true&separator=-&symbols=true&upper=true&words=6'
```

Web page: https://lookupowl.com/password-generator?mode=passphrase&words=6

### Readable password without look-alikes

```json
{"mode":"password","length":16,"lower":true,"upper":true,"digits":true,"symbols":false,"excludeSimilar":true,"exclude":"","requireEach":true,"separator":"-","capitalize":false,"includeNumber":false,"count":3}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/password-generator?capitalize=false&count=3&digits=true&exclude=&excludeSimilar=true&includeNumber=false&length=16&lower=true&mode=password&requireEach=true&separator=-&symbols=false&upper=true'
```

Web page: https://lookupowl.com/password-generator?q=16&count=3&excludeSimilar=true&symbols=false

### 6-digit PIN

```json
{"mode":"pin","length":6,"lower":true,"upper":true,"digits":true,"symbols":true,"excludeSimilar":false,"exclude":"","requireEach":true,"separator":"-","capitalize":false,"includeNumber":false,"count":1}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/password-generator?capitalize=false&count=1&digits=true&exclude=&excludeSimilar=false&includeNumber=false&length=6&lower=true&mode=pin&requireEach=true&separator=-&symbols=true&upper=true'
```

Web page: https://lookupowl.com/password-generator?q=6&mode=pin

## Web pages

- https://lookupowl.com/password-generator

## Limits and caching

- Cost: 1 unit for a live lookup, 1 unit for a cached one. Budgets are per network and published in the `RateLimit` response headers.
- Cache: results are never cached.
- Timeout: 1 s.

## Related tools

- [SSL Certificate Checker](https://lookupowl.com/tools/ssl-checker.md): Check a site's SSL/TLS certificate: days until it expires, whether it is trusted, matches the host and has a complete chain.
- [HTTP Headers Checker](https://lookupowl.com/tools/http-headers.md): Fetch a URL, follow its redirects and see every response header, with a security-header grade and caching summary.

## Guide: Password generator

Strong, random passwords made right here in your browser, so the password itself never leaves your device.

### What this generator does

The generator builds passwords from your browser's cryptographically secure random number generator (`crypto.getRandomValues`), not from `Math.random()`, which is predictable and unsuitable for secrets. Next to each result the page shows its entropy in bits, a measure of how hard it is to guess. Each extra bit doubles the guesses an attacker needs. The label beside it follows the bits: Weak under 40, Fair under 60, Strong under 80 and Very strong from 80.

| Mode | What you get | Entropy for the default |
|---|---|---|
| Password | 20 random characters from an 87-character pool of lowercase, uppercase, digits and symbols | About 129 bits (Very strong) |
| Passphrase | 6 words from a 1,024-word list, 10 bits per word, joined by hyphens | 60 bits (Strong) |
| PIN | 6 random digits | About 20 bits (Weak), so only for services that limit guesses |

### How to use it

1. **Choose a type**: Passwords suit anything stored in a password manager. Passphrases suit the few secrets you must type or remember, like a laptop login or your password manager's master password. PINs are only for services that limit wrong guesses.
2. **Set the length and character classes**: Length matters more than variety, so raise it before you add symbols. Under More options, “Avoid look-alike characters” helps if you will read the password aloud or copy it from paper, and “How many” makes several at once.
3. **Copy it into a password manager**: Use a different one for every account, and don't email or message it to yourself.

> **Privacy: this page versus the API** On this page the password is made inside your browser tab and never leaves your device. It doesn't go to our server or to Google Analytics, which only receives some of your settings (see the first question below). The same generator is also offered through the API and the `password_generate` MCP tool for scripts and agents. Those calls run on our server, are never cached and keep the password out of our logs. For a password you will really use, prefer this page or your password manager's own generator.

### Length, entropy and what is enough

Entropy counts the equally likely possibilities, in bits. Each added character multiplies the possibilities by the size of the pool. As a rough guide, online guessing is slow and rate-limited, so 40 to 50 bits holds up there. If a site's password database is stolen, attackers can guess offline. Fast hashes let a single graphics card try billions of guesses a second, so aim for 80 bits or more for anything important.

| Type | Entropy | Guideline |
|---|---|---|
| 8 random characters, all classes | About 51 bits (Fair) | Too short for anything important |
| 12 random characters, all classes | About 77 bits (Strong) | Reasonable for ordinary accounts |
| 16 random characters, all classes | About 103 bits (Very strong) | Strong for most uses |
| 20 random characters, all classes | About 129 bits (Very strong) | Beyond brute force |
| 6-word passphrase (1,024 words) | 60 bits (Strong) | Good for memorised secrets with a rate limit |
| 8-word passphrase | 80 bits (Very strong) | Strong even offline |

### Problems and good habits

- **A site rejects the password.** Some sites cap the length or refuse certain symbols. Turn symbols off, or list the ones to avoid under Exclude characters, and make the password longer to compensate. The symbol set already leaves out quotes, backslashes, spaces and backticks, so passwords drop into JSON and single-quoted shell commands without escaping.
- **Required character classes.** Keep “Require every selected class” on so every result has at least one character from each class. The entropy figure already accounts for it.
- **Typing on a phone or TV.** A passphrase with a simple separator is far easier to enter than symbols.
- **Reusing passwords.** Even a perfect password is weak once it is reused. One unique password per site is the rule.
- **Sharing one.** Send one-time secrets with a tool that expires them, not in plain chat.
- **Two-factor authentication.** A passkey or an authenticator app protects you even if a password leaks.

> **Do not paste real passwords into online strength checkers** This site never asks for a password to test. Any web page that does can read what you type and send it somewhere. Use your password manager to check strength instead.

### How the randomness works

The generator draws unbiased random integers. It throws away values that would skew the odds, which is called rejection sampling, instead of using a modulo, which slightly favours some characters. A password is a string of characters drawn from the pool of every class you turned on. If you require every class, a draw that misses one is thrown away and drawn again, so the result is uniformly random among all valid passwords. A passphrase picks words from a fixed 1,024-word list, so each word adds exactly 10 bits. “Add a number” puts one random digit on one random word and adds a few more bits. The entropy figure is worked out from the real pool size and the require-every-class rule.

Randomness comes from the Web Crypto API, backed by the operating system's secure random generator. Official guidance is in NIST SP 800-63B, which favours length and a blocklist of breached passwords over arbitrary composition rules, and lets people use password managers.

### Frequently asked questions

**Is it safe to generate a password online?**

Yes, when the password is made on your own device and sent nowhere. On this page it is. Your browser's secure random generator makes it, and it never goes to our server or to Google Analytics. Analytics does receive some settings, such as the type, length, how many and which character classes are on, but never the exclude and separator boxes. Be wary of generators that make passwords on their own server.

**How long should my password be?**

16 random characters is a good default, and 20 or more suits important accounts such as email, banking and your password manager's master password. Length beats complexity: every extra character multiplies an attacker's work, while a rule like “must include a symbol” adds little. If you have to remember it, use a passphrase.

**Are passphrases as secure as passwords?**

Not at the same length, but a long enough passphrase can match one. Six words from the 1,024-word list give 60 bits, which holds up against online guessing but is modest if a stolen password database is attacked offline. Eight words give 80 bits. Use eight words, or a long random password, for anything important.

**What does “avoid look-alike characters” do?**

It removes characters that are easy to confuse, such as `i`, `l`, `L`, `I`, `1`, `o`, `O` and `0`. The password is slightly weaker per character, because the pool is smaller, but easier to read aloud and type. The entropy shown already accounts for the smaller pool.

**Can I generate many passwords at once?**

Yes. Set How many under More options, up to 50 at a time. The page starts with three. It makes a new batch whenever you change a setting, or when you press Make new ones. Each one is independent and made with the same secure random source.

**Why not use my own pattern, like a favourite phrase with numbers?**

Predictable patterns are exactly what cracking tools try first, and their rule sets already cover the usual tricks. Swapping letters for numbers, like `a` for `4`, or adding an exclamation mark at the end barely slows them down. Randomness is what makes a password strong.

**Why does the passphrase list have only 1,024 words?**

A short list keeps the page small and quick to load. Each word still adds exactly 10 bits, because it is chosen at random from all 1,024. You need a few more words than with a bigger list: six words give 60 bits here, against about 77 from the 7,776-word EFF list.