Utilore

Password Generator

A new password is generated the moment this page loads, using your browser's cryptographic random number generator. Nothing is transmitted, logged or stored.

How to use

  1. Set the length — 16 characters is a sensible minimum, 20 or more for anything important.
  2. Choose which character sets to include: uppercase, lowercase, digits, symbols.
  3. Turn on "no look-alike characters" if you will have to read the password out or type it manually.
  4. Press Copy, paste it into your password manager, and never reuse it on another site.

Good to know

Why length beats complexity

Each extra character multiplies the number of possible passwords, while swapping an "a" for an "@" adds almost nothing — attackers' wordlists already contain those substitutions. A 20-character random password from a 90-character alphabet has about 130 bits of entropy, which is far beyond any brute-force attack available today.

How the randomness works

The generator uses crypto.getRandomValues(), which draws from the operating system's cryptographically secure random source — not Math.random(), which is predictable and unsuitable for secrets. Values that would introduce modulo bias are discarded and redrawn, so every character is equally likely.

What to do with the password

Store it in a password manager rather than in a note or a browser form you cannot audit. Use a different password for every service so that one leak cannot open the rest, and enable two-factor authentication wherever it is offered.

Frequently asked questions

Is this password generator safe?

The password is created entirely in your browser with the OS cryptographic random source. It is never sent over the network, never logged and never stored — reloading the page discards it.

How long should a password be?

At least 16 characters for ordinary accounts and 20 or more for email, banking and password-manager master passwords. Length matters far more than exotic symbols.

What does the entropy number mean?

It estimates how many random bits the password contains: under 60 bits is weak, 60–90 is fair, above 90 bits is strong against any realistic offline attack.

Why avoid look-alike characters?

Zero and capital O, one and lowercase L look identical in many fonts. Excluding them helps when a password has to be read aloud, written down or typed on a TV or console.

Can I generate a password offline?

Yes. Once the page has loaded you can disconnect from the internet — the generator keeps working because it runs locally.

Do you store the passwords you generate?

No. There is no server involved: the password exists only in your browser tab until you close or reload it.

Related tools