What is a password generator?
A password generator creates random, unpredictable strings suitable for account credentials, Wi-Fi keys, database users, and staging environments. Humans are bad at randomness — we pick names, dates, and keyboard patterns that attackers guess quickly. A generator draws from the full character set you allow, producing entropy no one would memorize by accident.
This tool lets you set length from 8 to 128 characters, toggle lowercase, uppercase, digits, and symbols independently, and optionally strip ambiguous look-alike characters. One click produces a new password; another copies it to your clipboard. Everything runs locally, so your secrets never traverse the network.
How to use the password generator
- Set the length slider — 16 is a solid default for most websites; increase for master passwords or service accounts.
- Choose character sets. Enable all four for maximum entropy unless the target system forbids certain symbols.
- Enable Exclude ambiguous if you will read the password over the phone or print it for a kiosk.
- Click Generate until you are satisfied — each click is independent and equally random.
- Copy and paste into a password manager immediately; avoid leaving high-value passwords in plain text files.
Examples
Balanced 16-character password
Lowercase, uppercase, digits, and symbols enabled — typical output looks like Kp9#mQx2$vLn4@wRz. Every position is independently random from roughly 90+ characters.
Wi-Fi passphrase style
Length 20, symbols off, ambiguous excluded — easier to type on a TV remote while still strong because length compensates for the smaller alphabet.
Service account for automation
Length 32+, all sets on — paste into CI secrets or a vault, then store the username alongside a UUID as the account identifier for traceability.
Understanding password strength
Strength comes from entropy — how many guesses an attacker needs in the worst case. A charset of 94 printable ASCII symbols and a 16-character password yields up to 94¹⁶ possibilities, far beyond brute force at human scales. Real attacks use dictionary words, leaked password lists, and site-specific rules, which is why randomness from a generator beats clever human patterns.
NIST and modern guidance emphasize length and breach detection over forced rotation every 90 days. Unique passwords per site matter most: a random 16-character password stored only in a password manager beats a memorable 24-character reuse across ten services.
Character set options explained
- Lowercase (a–z) — 26 characters; base of many passphrases.
- Uppercase (A–Z) — doubles letter variety; required by some corporate policies.
- Digits (0–9) — needed when sites demand numbers; combine with exclude ambiguous if zeros cause confusion.
- Symbols — punctuation expands entropy sharply; verify the app accepts your chosen symbols before saving.
- Exclude ambiguous — removes 0, O, 1, l, I for human-friendly transcription.
Best practices
- Use a password manager so you only memorize one master secret while every site gets a unique random password.
- Enable two-factor authentication wherever available — passwords are one layer, not the whole defense.
- Never email or chat passwords in plain text; use secure share features with expiry.
- Regenerate after exposure — if a password appeared in a log or ticket, replace it and audit access.
- Hash for verification, not storage — developers checking test fixtures can use the Hash Generator, but production apps must use proper password hashing libraries.