Password Generator

What is a password generator?

A password generator is a tool that assembles a string of characters at random, rather than asking you to think one up, because human-invented passwords are never as random as they feel. This one draws every character from crypto.getRandomValues, the browser's cryptographic random source, not the predictable Math.random() that plenty of generators still use, and maps each draw onto the character pool by rejection sampling so no character is ever favored over another.

The pool spans 85 characters — 26 lowercase letters, 26 uppercase, 10 digits, and 23 punctuation marks (!@#$%^&*()-_=+[]{}:;,.?), deliberately missing quotes, backslash, backtick and space, the characters most likely to get mangled by a shell script, a CSV export or a login form with fussy rules. Tick the kinds of characters you want and every kind you tick is guaranteed to appear at least once in the result — not just allowed to appear, guaranteed.

How to use it

1. Set the length. Type a number or drag the slider anywhere from 4 to 64 characters; 16 is the default and a reasonable starting point.
2. Choose which character kinds to include. Lowercase a-z, Uppercase A-Z, Numbers 0-9 and Symbols !@#$ are all on by default — untick any you don't need, or tick Exclude look-alikes (0 O o 1 l I) if you'll be retyping the password by hand off a screen.
3. Copy the result. Press Copy (it flashes Copied! for two seconds) or Generate again for a fresh draw — the strength bar, strength word and entropy in bits update the instant you change anything.

How strong is strong enough?

Length matters, but only in combination with what you allow in the pool. An 8-character password using all four kinds carries 50.2 bits of entropy — enough to fall in minutes to an offline attacker running a trillion guesses a second, the rate GPUs reach against a leaked database that wasn't hashed properly. Stretch that to 12 characters under the same rules and you get 76.5 bits, pushing the crack time out to centuries. At the 16-character default, it's 102.3 bits, well beyond any timescale worth naming.

Those figures already account for something most generators skip: requiring at least one of each character kind shrinks the space of possible passwords below the number everyone quotes. The textbook formula for 16 characters across an 85-character pool prints 102.55 bits; the true count, worked out by inclusion-exclusion over the required kinds, is 102.32. The gap is small at that length and grows the shorter the password gets relative to how many kinds you demand.

Excluding look-alikes drops the pool from 85 characters to 79 and costs 1.77 bits at the default length — about a quarter of one character. Keep in mind the crack-time bands assume an offline attack against an unsalted or weakly hashed database: the worst case for you, the best case for an attacker. A login form that rate-limits attempts, or a site that hashed your password properly with bcrypt or argon2, buys you far more time than the number above suggests.

What this tool cannot do

Generating a strong password is the easy part; where you keep it afterward is the hard part. Most password generators online are the front door of a password-manager sales funnel, and for once the funnel has a point — a generated password is only as safe as the place you store it. Write it on a sticky note or drop it in an unencrypted notes file and every bit of entropy above was wasted. Use a password manager, any reputable one; we don't sell one and won't pretend to recommend one over another.

Nothing here checks whether a password has ever appeared in a data breach. That would require sending it, or a hash of it, to a server somewhere, and this tool makes no network request of any kind — everything happens in your browser tab, nothing is logged, nothing is stored, and reloading the page loses the result. Copy it before you close the tab, because there is no history to come back to.

The five strength bands and the bit thresholds behind them are a judgment call, not a published standard — a reasonable way to translate a number into a word, not a guarantee. And no strength meter, ours included, can see whether you've used this exact password somewhere else already. Reuse is invisible to the math, and it's how most accounts actually get broken into.

Why is it free?

This runs entirely in your browser — there's no server generating your password, no account to create, no watermark on the result and no paid tier hiding a feature you actually need. FreeToGenerate.com builds tools this way because a password generator doesn't need to know who you are, and the moment one asks, that's a sign to close the tab.