Generators Password generator
Generate strong random passwords using your browser's cryptographic randomness, with entropy shown in bits and no password ever transmitted.
89 possible characters per position.
Generated with your device’s own secure randomness
Your files stay on your device. The tool works directly in your browser, using your device to process your files. Nothing is sent to our servers, and we never receive, store, or see your files or figures.
Cite
Cite this page
Reembun. (2026, July 27). Password generator. https://reembun.com/password-generator
How to use it
Set the length
Length does more for strength than anything else on this panel. Sixteen characters is a sensible floor.
Pick the character sets
Lowercase, uppercase, numbers and symbols. Avoid look-alike characters drops the ones that are hard to tell apart when read aloud or typed from paper.
Read the strength
The meter estimates how much guessing the password would take, and it moves far more when you add length than when you add symbols.
Copy it and store it now
Passwords are generated in your browser with the operating system random source. Nothing is sent, and nothing survives the page reload, so put it in your password manager straight away.
Where the randomness comes from
Every character is drawn from the cryptographically secure random number source built into your browser. It is seeded by your operating system’s entropy pool, which draws on hardware sources, timing jitter and other unpredictable input, and it is the same quality of randomness used to secure an encrypted connection.
The ordinary, everyday random function that most sites reach for is deliberately never used. It is fast, it is not seeded securely, and its output is predictable from a handful of observed values. It is fine for shuffling a playlist and unfit for anything protecting an account.
Why the sampling method matters
Squeezing a raw random number into a 94-character alphabet has an obvious wrong answer, and most generators take it. Because the raw range does not divide evenly by 94, the early characters in the alphabet come up slightly more often than the later ones. The bias is small, but it is a bias in exactly the place where uniformity is the whole point.
This generator avoids it. Any draw that would fall in the uneven tail is discarded and taken again, so every character in the alphabet is exactly equally likely.
It also guarantees at least one character from each enabled set, without stacking them at the front: the required characters are drawn first, the remainder fills from the whole alphabet, and the result is then shuffled.
Entropy, in numbers
entropy (bits) = length × log₂(alphabet size)| Length | Lowercase only (26) | Letters + digits (62) | All sets (94) |
|---|---|---|---|
| 8 | 37.6 bits | 47.6 bits | 52.4 bits |
| 12 | 56.4 bits | 71.5 bits | 78.7 bits |
| 16 | 75.2 bits | 95.3 bits | 104.9 bits |
| 20 | 94.0 bits | 119.1 bits | 131.1 bits |
A useful reference point: 128 bits is the standard target for cryptographic keys. Anything at or above it is not going to be brute-forced by anyone, ever.
Notice that a 16-character lowercase password (75 bits) beats a 12-character password using every symbol class only marginally, and beats an 8-character one using every class comfortably. Length is the cheaper lever than complexity, and it is the one humans tolerate better.
What entropy does not protect against
A perfectly random password is worthless if it is reused. Credential-stuffing attacks do not guess passwords; they replay ones already leaked from another breach. Strength protects against brute force, uniqueness protects against reuse, and only a password manager gives you both at scale.
Nor does entropy help if the password is phished. Enable two-factor authentication wherever it is offered, preferably an authenticator app or hardware key rather than SMS, which is vulnerable to SIM-swap.
Modern guidance
NIST’s SP 800-63B reversed decades of received wisdom. It now recommends against mandatory periodic password changes, and against forced composition rules like “must contain a symbol”. Both push people toward predictable patterns, such as Password1! becoming Password2!. What it recommends instead is length, a check against known-breached password lists, and no arbitrary maximum length.
Common questions
Is it safe to generate a password on a website?
It depends entirely on whether generation happens on your device or on a server. This one runs in your browser, so the password is never transmitted, never logged and never exists outside this tab. You can verify that by opening your browser's network panel and watching that no request fires when you click Regenerate. A generator that produces passwords server-side has, by construction, seen your password.
What does entropy in bits actually mean?
It is the base-2 logarithm of the number of possible passwords your settings could produce. Each additional bit doubles the search space. A 20-character password from a 94-character alphabet has about 131 bits, meaning roughly 2¹³¹ possibilities, beyond any conceivable brute-force effort. Below about 60 bits, an offline attack against a fast hash becomes realistic.
How long should a password be?
For anything protected by a password manager, 20 or more characters costs you nothing since you never type it. For a master password or something you must memorise, a long passphrase of five or six random words is easier to remember and stronger than a short scrambled string. Length beats complexity: a 16-character lowercase-only password has more entropy than a 10-character one using every symbol.
Why avoid look-alike characters?
If you will ever read the password aloud, copy it from a screen, or type it from a printed sheet, characters like 0/O and 1/l/I cause real errors. Turning that option on removes roughly 20 characters from the alphabet, costing about 0.3 bits per character. That is worth it for a Wi-Fi password on a café wall, and unnecessary for something living in a password manager.
Last reviewed
