Password Generator

How do you generate a password that matches a site's rules?

Select Password, set Length, and choose the character types the site accepts. Click Generate New for a fresh result, then Copy to use it. The initial result is 16 characters long with uppercase letters, lowercase letters, digits, and symbols enabled. Changing a setting immediately generates another result, so copy only after finishing your adjustments.

For a concrete setup, suppose a site accepts 20 characters, requires at least two digits and one symbol, and accepts only exclamation marks and underscores as symbols. Set Length to 20, leave the desired letter types enabled, and open Site rules. Set the 0-9 minimum to 2, the !@#$ minimum to 1, and Symbols allowed to !_. Every successful result meets those minimum counts; the remaining positions use the enabled pool. Merely enabling a type does not guarantee its presence because the default minimum for every type is zero.

Which mode should you choose: password, passphrase, or PIN?

Choose the mode according to the destination's input requirements and how you will enter the result. A passphrase produces words joined by a separator, while Password produces individual characters and PIN produces only digits. These modes have different controls; the password-specific exclusions and site rules are not applied to PIN or Passphrase.

Available modes and their controls

Mode	UI range and default	Useful controls
Password	8-128 characters; default 16	Character types, exclusions, minimum counts, and repeat limits
Passphrase	3-10 words; default 5	Separator, Capitalize, and Include number
PIN	4-12 digits; default 6	Length and Multiple

In Passphrase, Separator offers dash, dot, underscore, or space. Choose Custom to enter up to three characters, or leave the custom value empty to join words without separators. Capitalize changes the first letter of each word; it does not create a second random choice between cases. Include number appends one digit to one selected word. The current bundled list has 908 words, so the displayed five-word estimate without numbering is 49.1 bits. This is not a generator based on a 7,776-word Diceware list.

How does this password generator choose random characters?

Password and PIN generation use crypto.getRandomValues() through a helper that performs rejection sampling. It rejects random integers outside an evenly divisible range before mapping the accepted value to a character index. This avoids modulo bias in the individual index selection. When minimum counts are requested, the engine shuffles positions for those required characters and fills each position from the currently eligible pool.

Generation happens locally in the browser; the generation functions do not send the result to a server. Constraints still affect which outputs are possible. Do not interpret unbiased individual draws as a promise that every complete password satisfying several combined rules has exactly the same probability. The engine retries dead ends up to 200 times, then reports that it could not satisfy the rules and asks you to relax a rule or increase the length.

What makes a password strong, and what does the bit count mean?

For an unrestricted character pool, the tool estimates entropy as length × log2(pool size). Its default pool contains 26 uppercase letters, 26 lowercase letters, 10 digits, and 26 symbols: 88 possible characters. At the default length, 16 × log2(88) = 103.35 bits, rounded to 103b in the output. The displayed rating is Weak below 40 bits, Fair from 40 to below 60, Strong from 60 to below 80, and Very Strong from 80 upward.

Start with a letter and No consecutive repeats reduce the calculation. Minimum counts and Max same character repeats are not subtracted, so the estimate is an upper bound when those restrictions apply. The estimated crack time assumes 10 billion guesses per second and half the estimated search space. It is a calculation under fixed assumptions, not a prediction for a particular account, password-hashing scheme, or attacker.

NIST SP 800-63B-4 requires verifiers to set a minimum of 15 characters for passwords used as a single authentication factor. For passwords used only within multi-factor authentication, it permits a shorter minimum of at least eight characters. Those are verifier requirements, not a claim that this generator certifies an account or its authentication setup.

How do exclusions and repeat limits change the result?

Exclude ambiguous (0O1lIo) removes those six characters from enabled pools. Exclude characters removes any characters you specify across all character types. Symbols allowed controls the symbol pool; if symbols remain enabled but that pool is empty after exclusions, the generator reports an error. Required minimums whose sum exceeds Length also produce an error rather than a shorter password or an incomplete result.

No consecutive repeats prevents identical neighboring characters. Max same character repeats limits total occurrences of each character across the whole password, with Off or a cap from 1 to 4. These controls solve different requirements: a character may appear twice in separated positions under the first rule, but a total cap of 1 forbids that. Start with a letter also requires an enabled letter pool with at least one letter remaining.

Should you use a password manager, and what stays in this page?

Use a separate password for each account and save the result in your password manager. This page is a generator rather than a persistent vault. Generate New moves the previous output into Session History, which retains up to 10 entries in component memory. Clear history empties that list. Hide masks the visible output and history; it does not erase their underlying values.

Multiple initially generates five results and lets you select from two to ten. Copy All joins them with newlines; Download .txt creates an unencrypted passwords.txt file. For other local utilities, see the Generators category or the Random Number Generator.

After copying, Clear clipboard after defaults to 30 s, with Off, 15 s, and 60 s also available. The page attempts to overwrite the clipboard only when clipboard-read permission is already granted and the contents still match its copied value. A later copied value is left alone. Automatic clearing is not guaranteed, and it does not remove downloaded files or copies retained by a clipboard manager. Check that the result is saved where you intended before leaving the page.