To create a strong password, leave Mode on Standard, set Length to at least 16, keep Uppercase, Lowercase, Numbers and Symbols ticked, and select Generate. The password is built from your browser's cryptographic random number generator and appears with a strength estimate. Select Copy main password and save it in a password manager.
How to use the strong password generator
- Pick a mode. Standard gives the strongest result per character. Pronounceable and Passphrase are easier to type but carry less randomness per character.
- Set the length. Drag the Length slider anywhere from 4 to 128. The default is 16. In Passphrase mode the slider sets the number of words, from 3 to 12 (default 6).
- Choose characters. Tick Uppercase, Lowercase, Numbers and Symbols, and add Exclude similar or Exclude ambiguous symbols if the password will be typed by hand or pasted into a config file. Type any other characters to avoid in Exclude Characters.
- Generate and copy. Choose How Many (1 to 50), select Generate, then use Copy main password, the Copy button next to each password, or Download TXT.
How long should a strong password be?
Length matters more than anything else. NIST's Digital Identity Guidelines (SP 800-63B-4, finalised in 2025) require passwords used on their own to be at least 15 characters, allow a minimum of 8 only when the password is one part of multi-factor authentication, and tell services to accept at least 64 characters. The same guidance drops forced character-mix rules and routine password changes, and asks services to block passwords known to be compromised.
For a randomly generated password you don't have to remember, 16 characters or more is a sensible default, and 20 or more costs you nothing when a password manager fills it in. Use a different password for every account, so one leaked site doesn't expose the others.
Password generator 8, 12 or 16 characters compared
Each character picked at random from the full set (26 uppercase, 26 lowercase, 10 digits and 32 symbols, 94 in all) adds about 6.55 bits of entropy. Every extra bit doubles the number of guesses an attacker needs.
| Length | Entropy, all 94 characters | Entropy, letters and digits only | Suitable for |
|---|---|---|---|
| 8 characters | 52 bits | 48 bits | Only where a site caps length, and only with two-factor login |
| 12 characters | 79 bits | 71 bits | Low-value accounts with two-factor login |
| 16 characters | 105 bits | 95 bits | Most accounts; this tool's default |
| 20 characters | 131 bits | 119 bits | Email, banking, admin and hosting accounts |
These figures hold for truly random passwords like the ones made here. A human-chosen password of the same length is far weaker, because people pick words, names and patterns that attackers try first. The entropy shown in the tool is worked out from your settings and the size of the pool each character is drawn from, not guessed from the finished password.
Memorable password generator modes
Two modes trade some strength for passwords you can read or type easily:
- Pronounceable alternates consonants and vowels like
tobaruki, capitalises one consonant when Uppercase is ticked, and adds two digits and a symbol at the end when Numbers and Symbols are ticked. A vowel adds only about 2.3 bits and a consonant about 4.4, so a 16-character pronounceable password carries roughly 59 bits against about 105 in Standard mode. Make it longer. - Passphrase joins words with your Separator (default
-), with options to capitalise words, add a two-digit number and add a symbol. In this mode the slider sets the number of words.
Passphrase words come from the EFF large wordlist of 7,776 words, so each word adds about 12.9 bits. Six words, the default, come to about 77 bits; the number adds 6.6 bits and the symbol about 4. Capital letters and the separator are fixed choices, so they add nothing. For a passphrase you'll memorise, such as a password manager's master password, use six or more words, or use Standard mode for anything stored in a manager.
How this random password generator works
Every character, letter and word is chosen with crypto.getRandomValues(), the browser's cryptographically secure random number generator, not Math.random(), using rejection sampling so no character or word is more likely than another. Generation happens on the page; passwords aren't sent to ToolzyLab or stored anywhere, and they're gone when you close the tab.
Require each selected type (on by default) guarantees at least one character from every ticked group by redrawing any password that misses one, so the required characters can land anywhere. Exclude similar drops characters that are easy to confuse, such as O, 0, I, l and 1. The full symbol set includes quotes, backslash and backtick, which can break shell commands, CSV files and some login forms; Exclude ambiguous symbols limits symbols to !@#$%^&*_-+=~?.
Download TXT saves your passwords in a plain text file, so move them into a password manager and delete the file. If you need to share a password, encrypt it first with the text encryption tool. Developers who need unique IDs rather than secrets can use the UUID generator.
Frequently asked questions
Is this password generator safe to use?
Yes. Passwords are generated in your browser with crypto.getRandomValues() and are never uploaded or saved by ToolzyLab. Close the tab when you're done.
How many characters should a strong password have?
At least 15 for a password used on its own, following NIST SP 800-63B-4, and 16 to 20 for a random password stored in a password manager.
Can I make a 12-character or 8-character password?
Yes. Drag the Length slider to 12 or 8. An 8-character password is short by current standards, so use it only when a site won't accept more and you also have two-factor login.
Should passwords include symbols?
Symbols add strength per character, but length adds more. If a site rejects certain symbols, tick Exclude ambiguous symbols or list the characters in Exclude Characters, and add a few characters of length instead.
What does Strong preset do?
It sets Standard mode, 20 characters, all four character types, Exclude similar, Require each selected type and Avoid repeated adjacent chars, and prepares 10 passwords. Select Generate to create them.
Can I generate several passwords at once?
Yes. Choose 5, 10, 20 or 50 under How Many. Each password gets its own Copy button, and Copy All Passwords or Download TXT exports the whole list.