ToolKitly

Strong Password Generator

Create passwords that are genuinely random, using your browser cryptographic random source. Nothing is sent over the network and nothing is stored.

Include

Leaves out 0/O, 1/l/I and quotes — useful when the password will be typed by hand.

StrengthExcellent · 129 bits of entropy

All processing happens in your browser. Files are never uploaded to a server.

At a glance

Processing
In your browser - nothing is uploaded
Price
Free, no account

How to use

  1. Set the length. 16 characters or more is a good target.

  2. Choose which character types to include.

  3. Turn on "Exclude look-alike characters" if you will type the password by hand.

  4. Click "Generate password" and copy the result.

Frequently asked questions

Are these passwords actually random?

Yes. They use the browser cryptographic random number generator, the same source used to create encryption keys. Many online generators use Math.random, which is predictable and completely unsuitable for passwords.

Is it safe to generate a password on a website?

With this tool, yes - generation happens entirely in your browser, so the password is never sent over the network, never logged and never seen by any server. You can verify this by disconnecting from the internet: the tool keeps working.

How long should my password be?

For a random password, 16 characters with mixed types gives around 100 bits of entropy, which is far beyond brute-force reach. Go to 20 or more for accounts that protect money, email or infrastructure.

What does the entropy number mean?

Entropy measures how many guesses an attacker would need. Each extra bit doubles that number. Below 60 bits is weak against a determined attacker, 80 or more is strong, and 128 is far beyond any realistic attack.

Does entropy apply to passwords I make up myself?

No, and this is a common trap. The entropy shown here assumes every character was chosen at random. A human-chosen password like "P@ssw0rd2024!" has the same character types but far less real entropy, because attackers try predictable substitutions first.

Should I reuse a generated password?

No. The strongest password still fails if it is reused and one site is breached. Use a unique password per account and a password manager to store them.