Random Password Guide: Length First, Real Randomness Second
Password strength comes from length and real randomness, not from looking complicated. This tool generates in your browser without a network request, and it will not remember anything for you.
Open the tool：Random Password Generator
When to reach for it
Signing up for a service, initialising a database account, setting a temporary server password, creating a read-only account for a colleague: none of these should be invented by a human. Human-chosen passwords cluster into patterns that dictionaries hit first.
Test accounts and per-environment keys need distinct values quickly. Generate once, store it in a password manager, and take it from there afterwards. Reuse is the risk, not the alphabet.
- New accounts, databases, server credentials
- Separate passwords for every environment
- Temporary and test accounts
Where the randomness comes from
Values come from crypto.getRandomValues, the browser interface to the operating system's cryptographic random source. Math.random is a predictable generator and must never produce passwords, tokens, or keys. That is the difference between looking random and being random.
The default alphabet drops easily confused characters, leaving 56 symbols, so 16 characters is about 93 bits of entropy. Enabling symbols raises it to 69 characters and roughly 98 bits. Adding length is the better lever: every extra character multiplies the search space.
- crypto.getRandomValues, never Math.random
- 16 characters from 56 symbols is about 93 bits
- Length beats alphabet size
Boundary: generating is the easy part
Everything happens locally. Close the tab and the password is gone; nothing is stored or uploaded. The trade-off is that you must save it immediately in a password manager. Sending it over chat or pasting it into a ticket makes it public.
It cannot stop phishing, credential stuffing, or a server-side breach, and it does not fix password reuse. Some legacy systems cap length or reject symbols; when that happens, follow their rules and compensate with the longest length allowed.
- No network, no storage, gone when the tab closes
- Cannot stop phishing, stuffing, or server breaches
- When a system limits symbols, use more length
FAQ
Why are some characters missing?
The defaults drop characters that are nearly indistinguishable in many fonts, which makes hand-copying and phone dictation error-prone. Excluding them costs very little entropy and reduces transcription mistakes.
How long should a password be?
Start at 16 characters for ordinary accounts and go past 20 for important ones. Length helps far more than a fancier alphabet; not reusing passwords and storing them in a manager matters more than either.
Is the password uploaded anywhere?
No. Random generation and assembly happen in the browser with no network request. You can use it offline, and you can confirm with developer tools that nothing is sent.
Related tool：Random Password Generator