Skip to content
Tooletto

Strong Password Generator

A preset of Password Generator

Preset to 24 characters using every character set — roughly 150 bits of entropy, which no brute-force attack can touch. Use it for anything you store in a password manager, where length costs you nothing.

  • Files never leave your device
  • Free, no signup
  • No watermarks
  • Works offline once loaded
Loading tool…

How to password generator

  1. 1

    Choose a style

    Pick a random character password or a memorable multi-word passphrase.

  2. 2

    Set the length and character sets

    The strength meter shows the real entropy in bits as you adjust.

  3. 3

    Copy it

    Copy the password straight into your password manager.

Why maximum length costs nothing once a password manager is involved

A password that never needs to be typed by hand or remembered has no reason to compromise on length at all — the only real cost of a longer, more complex password is the human inconvenience of typing or recalling it, and a password manager removes both of those costs entirely by storing and autofilling the value. Twenty-four characters drawing from the full character set — uppercase, lowercase, digits and symbols — produces roughly 150 bits of entropy, an amount so far beyond any brute-force attack's reach that it approaches the practical ceiling of what "more secure" can even mean for a single account credential.

This preset is the right default specifically for anything stored in a password manager and never typed manually — most online accounts, in practice, for anyone who has adopted one — where there is no reason to trade any strength away for memorability, since memorability was never going to be needed.

Why similar-looking characters are left in rather than excluded here

Excluding visually ambiguous characters like `0`/`O` and `1`/`l`/`I` exists as an option specifically for passwords a person might need to read off a printout or type manually — for a password that only ever gets copied and pasted directly from a manager, that ambiguity never actually gets encountered by human eyes, so there is nothing to gain from excluding those characters and a small amount of entropy to lose by doing so. This preset leaves the full character set enabled for exactly that reason: maximum strength, on the assumption the value is being copied programmatically rather than transcribed by hand.

Frequently asked questions

Is it safe to generate a password on a website?

For this one, yes — passwords are generated by `crypto.getRandomValues`, your operating system's cryptographic random source, and never leave the page. There is no network request to intercept and nothing stored. You can disconnect from the internet and it still works, which you can verify yourself.

How long should a password be?

At least 16 characters from a mixed set, which gives about 100 bits of entropy — far beyond any feasible brute-force attack. Length matters far more than special characters: a 20-character lowercase password is stronger than an 8-character one with symbols.

What does the entropy figure mean?

Bits of entropy measure how many guesses an attacker needs. Each extra bit doubles that number. Below 50 bits is weak, 70–80 is reasonable, and above 100 is beyond the reach of any current attack.

Are passphrases as secure as random passwords?

Yes, when the words are chosen randomly. Four random words from a large list give roughly 52 bits; six give about 78. The advantage is that you can actually remember and type them — which matters for the handful of passwords you cannot store in a manager.

Why avoid similar-looking characters?

Because 0/O and 1/l/I are indistinguishable in many fonts. Excluding them costs a couple of bits of entropy and saves real frustration when a password has to be read aloud or typed from a printout.