FAQ
How are passwords generated?
Every password always starts and ends with a letter. The middle section guarantees at least one lowercase letter, one uppercase letter, and one digit. If extra characters are enabled, at least one is always included - but they are capped at 35% of the total length to keep passwords usable (this value can be adjusted in the ⚙ extended password settings if needed). The full character set is sampled uniformly using crypto.getRandomValues, a cryptographically secure random number generator built into your browser.
Are these passwords safe to use?
Yes. Passwords are generated entirely in your browser - nothing is ever sent to a server or stored anywhere (you can easily verify that by looking at the code which this website is built with). Each password is produced from cryptographic randomness, so there is no way to predict or reproduce a result after the page reloads.
What does the "Extra" option do?
Enabling Extra adds special characters (such as !?+-%~&*#@) to the character pool, which increases entropy significantly. At least one extra character is always guaranteed to appear in the result. To keep passwords readable and compatible with most services, extra characters are capped at 35% of the total length - so a 24-character password will contain at most 8 special characters. You can customise the exact set or pick a preset from the dropdown.
How is password strength calculated?
Strength is expressed as entropy in bits: log₂(pool size) × length. The pool size counts all distinct characters that could appear in a password of the chosen configuration. The crack-time estimate assumes 10²⁰ guesses per second across a billion supercomputers - a deliberately extreme scenario to give a conservative lower bound.
Can I use emoji or other special Unicode characters?
Multi-byte characters such as emoji are generally a bad idea in passwords. Many services, input fields, and authentication systems handle strings as raw bytes rather than Unicode code points, which means a single emoji can silently expand to 3-4 bytes and get truncated, mangled, or rejected entirely - often in ways that are hard to reproduce later. Keyboard availability is another issue: recovering access to your account from a different device or OS may be impossible if the required character is not easily typeable. For these reasons, this tool automatically strips any character outside the Basic Multilingual Plane (i.e. anything that requires a surrogate pair in JavaScript, such as emoji) from the Extra character field.
What length should I use?
24 characters with extra symbols is a solid default for most purposes (≥ 150 bits of entropy). If a service restricts special characters, a 32-character alphanumeric password provides comparable security. Anything below 16 characters should be avoided for sensitive accounts.
Related tools
String Generator - generate random strings with a custom character pool and length, useful for API keys, tokens, or secrets.
Hash Tool - compute MD5, SHA-1, SHA-256, SHA-384, or SHA-512 hashes of any text or file directly in your browser.
TOTP - manage two-factor authentication codes for your accounts, stored encrypted in your browser.
Cipher - encrypt and decrypt text using AES-256-GCM directly in your browser, with no data leaving your device.
UUID Generator - generate v4/v7 UUIDs, handy for unique identifiers in configs, databases, or APIs.