Generate a strong random password in your browser, choosing the length and which character sets to include.
Example
A random 8-character lowercase password has about 37.6 bits of entropy, while 16 characters using lowercase, uppercase, numbers and symbols reach about 102.55 bits, and 20 characters about 128.19 bits.
Calculation method
Characters come from the browser’s cryptographically secure random source. With all four sets enabled the generator guarantees at least one lowercase letter, one uppercase letter, one digit and one symbol, then shuffles them so their positions are not predictable.
Important notes
Passwords are created locally and never sent or stored, which also means they cannot be recovered — save a new password in a trusted password manager immediately, before submitting a form. The minimum length is 4 and the maximum is 256.
Length matters most
Choose a length and the character sets to include. Each additional character multiplies the number of possible passwords, so length adds strength faster than anything else. A random 8-character lowercase password has about 37.6 bits of entropy, which can be guessed quickly by modern offline cracking if a password database leaks. A 16-character password using lowercase, uppercase, numbers and the 23 available symbols has about 102.55 bits, and 20 characters reach about 128.19 bits, far beyond practical guessing.
Character sets and site rules
With all four sets enabled, the generator guarantees at least one lowercase letter, one uppercase letter, one digit and one symbol, then shuffles the characters so their positions are not predictable. That satisfies most sign-up rules. If a service rejects certain symbols, switch symbols off and add length instead: 12 characters of letters and numbers give about 71.45 bits. Numeric-only codes are weak by comparison; 6 random digits give about 19.93 bits, acceptable only for short-lived one-time codes with attempt limits.
Generated locally, saved nowhere
Passwords are created in your browser with its cryptographically secure random number generator and are not sent to ToolKivo or stored. That also means they cannot be recovered, so save a new password in a trusted password manager immediately, before submitting a form. Use a different password for every account, turn on two-factor authentication where available, and avoid reusing a generated password as a template by changing one character. The minimum length is 4 and the maximum is 256.
Worked examples| Input | Result |
|---|
8 · lowercase only | 37.6 bits |
12 · letters + numbers | 71.45 bits |
16 · all four sets | 102.55 bits |
20 · all four sets | 128.19 bits · one of each set |
6 · numbers only | 19.93 bits |
3 characters | rejected (minimum 4) |