Security tool
Strong Password Generator
Create a random password with your browser's cryptographic generator. Choose the length and character types, then copy it into your password manager.
How the generator works
The generator asks your browser for cryptographically secure random values, then maps them to the characters you selected. It does not use Math.random(), and it does not send the result anywhere.
At least one character is taken from each selected group, then the rest are drawn from the combined set and shuffled. That means a password will contain the kinds of characters you asked for, while the final order is still random.
Length beats clever substitutions
A long password made from a large alphabet has more possible combinations than a short password with a few symbols swapped in. Replacing “a” with “@” in a familiar word is easy for cracking tools to try. A random 20-character password is not.
The “bits” figure is an estimate of entropy: roughly how many guesses an attacker would need if the password were perfectly random. It is a useful comparison, not a guarantee. A password can still be exposed by a breach, a phishing page or malware on your device. For the reasoning behind length and randomness, read what makes a strong password.
What to do with the password
- Store it in a reputable password manager rather than a note or spreadsheet.
- Use a different password for every account.
- Turn on two-factor authentication where it is available.
- Change a password immediately if a service reports a breach.
Ambiguous characters
The “exclude ambiguous” option removes characters that are easy to confuse when reading or typing: i, l, 1, L, o, 0, O, |, backtick, single quote and double quote. This can help with passwords you have to read aloud or type by hand, at the cost of a slightly smaller alphabet.
Limits
No password generator can protect a device that is already compromised. Use this tool on a device you trust, and keep your browser and operating system up to date.
Keep going
Related tools
Other utilities that pair well with this one.
Good to know
Questions
Are generated passwords stored or sent anywhere?
No. Generation happens in your browser. NelcByte does not receive the password. Copy it into your password manager before closing the page.
How long should a password be?
For most accounts, 16 characters or more is a good target. Use longer values for high-value accounts, especially if you are not using two-factor authentication.
Should I use symbols?
Symbols increase the alphabet size, which helps. Length and randomness matter more. If a site rejects certain symbols, choose the longest password it allows with the character types it accepts.
Is a passphrase better?
A randomly chosen passphrase can be both strong and easier to remember. Use several unrelated words and enough total length. Avoid famous quotes, song lyrics or common phrases.
How many characters should a password have?
Use at least 12 to 16 random characters for important accounts, and longer if the service allows it. Length matters more than adding symbols to a short password.
Is it safe to generate a password in a browser?
The generator uses the browser's cryptographic random source and does not save or transmit the result. Store the password in a password manager rather than leaving it in the tab.