Password Generator

Password Advice

How to Use the Password Generator

1. 1. Set the length. The slider runs from 8 to 64 characters and starts at 16.
2. 2. Choose the characters. Lowercase, uppercase, digits and symbols are all on by default; at least one must stay on. Tick Exclude ambiguous characters to drop 0, O, 1, l and I.
3. 3. Read the strength line. The bar shows a band — Weak, Fair, Strong or Very strong — with the entropy in bits.
4. 4. Generate and copy. A password appears when the page loads; Generate New makes another and Copy puts it on your clipboard. Save it in a password manager straight away.

How the Passwords Are Made

• Secure randomness. Every character is chosen with crypto.getRandomValues, the browser's cryptographic generator, never Math.random. Values are drawn by rejection sampling, so no character is more likely than another because of rounding.
• One from each set. If you tick all four sets, the password is guaranteed to contain at least one lowercase letter, one capital, one digit and one symbol — a rule many sites still enforce. The remaining positions are filled from all selected characters, then the whole password is shuffled so the guaranteed characters do not sit at the front.
• The symbol set is !@#$%^&*()-_=+[]{};:,.?, 23 characters. If a site rejects some of them, untick Symbols and add length instead.
• Nothing leaves the page. The password is generated and held in your browser's memory and is not sent anywhere. Your operating system's clipboard history, if it keeps one, may retain what you copy.

Length Beats Complexity

The strength estimate is the entropy of a password chosen uniformly at random: length × log₂(size of the character set). With all four sets (85 characters) each character adds about 6.4 bits; with lowercase letters alone, 4.7. The tool rounds the result and labels it Weak below 40 bits, Fair from 40, Strong from 60 and Very strong from 80 — rules of thumb of this tool rather than an industry standard.

Length does more than variety. Twenty lowercase letters (94 bits) are stronger than twelve characters drawn from all four sets (77 bits), because every extra character multiplies the number of possibilities, while a bigger character set only raises the base. The estimate applies only to randomly generated passwords. A password you invent — or one with substitutions like p@ssw0rd — has far less real strength than its length suggests.

What Current Guidance Says

The US standard for digital identity, NIST SP 800-63B (revision 4), says services should require at least 15 characters for passwords used alone (8 when used with a second factor), allow at least 64, and not impose composition rules such as mixing character types or force periodic changes. It also expects services to accept password managers and pasting, and to check new passwords against lists of common and breached ones. In practice: choose the longest password the site allows, make it unique to that site, keep it in a password manager, and turn on two-factor authentication.

Which Tool Do You Need?

Use this page to create a new random password. To check one you already have, use the Password Strength Checker, which looks for common passwords, words and patterns and does not send anything either. For a unique identifier rather than a secret, use the UUID Generator; a UUID is unique but is not meant to be secret.

Frequently Asked Questions

Is it safe to generate a password on a website?

Here, yes: the password is created in your browser by its cryptographic random generator and is not sent over the network or stored, so CitationEasy never sees it. As with any tool, use a browser you trust, and put the result straight into a password manager.

How long should my password be?

At least 15 characters for an account protected by a password alone, according to NIST SP 800-63B, and longer where the site allows. For a password manager's master password, use a long passphrase. The slider here goes to 64 characters.

What does the strength estimate mean?

It is the number of bits of entropy: how many binary guesses it would take to be certain of finding the password, assuming it was chosen at random from the selected characters. Each added bit doubles the work. The bands are rules of thumb: under 40 weak, 40 to 59 fair, 60 to 79 strong, 80 and over very strong.

What does Exclude ambiguous characters do?

It removes 0, O, 1, l and I, which look alike in many fonts. That is helpful if you must read the password aloud or type it by hand, and costs very little strength: 16 characters from all four sets drop from 103 to 101 bits.

Why does a site reject my generated password?

Usually because it limits length or does not accept some symbols. Untick Symbols, or lengthen the password, and generate again. Sites that reject long or unusual passwords are worth avoiding where you have a choice.

Should I use the same password on multiple sites?

No. When a service is breached, attackers try the leaked passwords on other services. A unique password for each site limits the damage to one account.

Should I use a passphrase instead?

Several random words can be both strong and memorable, and are a good fit for a master password. This generator makes character passwords; for a passphrase, pick words at random rather than choosing them yourself.