Is this password actually sent anywhere?

No. It's generated entirely in your browser using the Web Crypto API and never leaves your device — there's no network request involved in generating or displaying it, as described above.

Why exclude lookalike characters?

Characters like I, l, 1, O and 0 are easy to misread in many fonts. Excluding them costs a small amount of entropy but avoids failed logins from misreading the password when typing it manually.

Is 12 characters long enough?

For the full character set used here, 12 characters gives roughly 78 bits of entropy — reasonable for most accounts, though 16 characters (around 103 bits) is a safer default. See "How to read the result" above for the thresholds this tool uses.

Password Generator

Generate a strong random password locally, without sending anything to a server.

Runs entirely in your browser — nothing you enter is uploaded.

How to use Password Generator

Drag the length slider to choose how many characters you need.
Tick or untick uppercase, digits and symbols to control which characters can appear.
Tick "Exclude lookalikes" if the password will be typed or read aloud rather than pasted.
Click Generate for a new password from the same settings, or Copy to copy the current one.

How this works

Characters are drawn from the selected sets using the Web Crypto API's crypto.getRandomValues(), which is seeded by the operating system's cryptographically secure random source. Math.random() is deliberately not used anywhere here — it is predictable enough to reconstruct output and is unsuitable for anything security-related. Selection uses rejection sampling rather than a modulo operation, so no character is more likely to appear than any other. Generation happens entirely in your browser; no password is transmitted, logged or stored.

entropy (bits) = length × log₂(size of character set)

Assumptions

Entropy assumes every character is chosen independently and uniformly at random, which holds because the password is machine-generated rather than chosen by a person.
The strength figure describes resistance to brute force only. It says nothing about phishing, keylogging, credential reuse or a breach at the service you use it on.
Excluding lookalike characters slightly reduces the character set and therefore the entropy.

Worked example

A 16-character password using uppercase, lowercase, digits and symbols.

Length: 16 characters
Character set size: 87
Result: About 103 bits of entropy

16 × log₂(87) = 16 × 6.44 = 103.1 bits. That is roughly 2¹⁰³ possible passwords — far beyond offline brute force with any foreseeable hardware. The symbol set here deliberately omits quotes, backslashes, backticks, pipes and tildes, because those are the characters most often rejected or mishandled by sign-up forms; that costs about two bits against the full 94-character ASCII set, which is a good trade. By comparison, an 8-character password from the same set gives only 52 bits, which is well within reach of a determined attacker with GPUs.

How to read the result

Treat anything below 60 bits as weak for an account that matters, 80 bits as reasonable, and 100 or more as strong. Length raises entropy faster than adding character types does: extending a lowercase-only password from 12 to 20 characters gains more strength than adding symbols to the 12-character version. Since a generated password is not memorable by design, use a password manager and never reuse it across services.

Limitations

Some sites impose maximum lengths or reject particular symbols, which may force a weaker password than you generated.
Entropy measures brute-force resistance only — it is not a measure of overall account security.
A password is only as safe as the device that generated it; a compromised machine compromises the output.

Frequently asked questions

Is this password actually sent anywhere?: No. It's generated entirely in your browser using the Web Crypto API and never leaves your device — there's no network request involved in generating or displaying it, as described above.
Why exclude lookalike characters?: Characters like I, l, 1, O and 0 are easy to misread in many fonts. Excluding them costs a small amount of entropy but avoids failed logins from misreading the password when typing it manually.
Is 12 characters long enough?: For the full character set used here, 12 characters gives roughly 78 bits of entropy — reasonable for most accounts, though 16 characters (around 103 bits) is a safer default. See "How to read the result" above for the thresholds this tool uses.