Password Generator

Length matters far more than exotic characters. NIST puts the floor at eight characters and asks systems to accept at least sixty-four, and it explicitly tells verifiers not to demand a mixture of character types — the rules that produce Password1! and a sticky note. The generator here leaves out characters that are easy to misread, such as l, 1, I, O and 0, and runs entirely in your browser.

How it is calculated

password = n characters drawn uniformly from the selected alphabet

Each character is drawn independently from the alphabet you enable, using the browser random number generator. Adding a character group widens the alphabet; adding length multiplies the number of possibilities, which is why length is the stronger lever.

Source: NIST SP 800-63B — memorized secrets SHALL be at least 8 characters if chosen by the subscriber, verifiers SHOULD permit at least 64 characters, and SHOULD NOT impose other composition rules

Questions people ask

Is a longer password better than a complicated one?

Yes, and the guidance agrees. NIST advises against forcing mixtures of character types, because the rules push people toward predictable substitutions. A long password from a smaller alphabet beats a short one stuffed with symbols.

Why are some characters missing?

Lowercase l, digit 1, uppercase I, uppercase O and digit 0 are excluded because they are easy to confuse when a password is read aloud or copied by hand. The cost in strength is negligible next to the cost of typing it wrong repeatedly.

Is this password sent anywhere?

No. It is generated by JavaScript in your browser and never leaves the page — there is no server here to send it to. Reload the page and it is gone.

How long should it be?

For an account protected by two-factor authentication, twenty characters from this generator is ample. Where a password is the only barrier, go longer: the field accepts up to 64, the ceiling NIST asks systems to support.

Related tools