How to Generate a Password in the Browser
By Tools Star Hub Editorial Team · Published · Updated
A generated password is a random string from the character types you select. The Password Generator uses the browser’s crypto.getRandomValues. Length can be 8 to 64. The default is 16. Uppercase, lowercase, and digits, with ambiguous characters left in, use a set of 62 characters. A 16-character password from that set is about 95.27 bits. The page rounds that estimate to 95 and labels it Strong.
A short word is easy to guess even when it looks personal. A longer random password from a large set is harder to guess by trying combinations. This page creates the password in the browser. It does not store it, and it does not check whether that exact string has appeared in a breach. You still have to save it in a place you control.
How is the character set built?
Uppercase adds A through Z. Lowercase adds a through z. Digits add 0 through 9. Symbols add !@#$%^&*()-_=+[]{};:,.? which is 23 characters. You need at least one set. The page refuses to generate from an empty pool.
Exclude ambiguous characters removes O, 0, I, l, and 1 from the letter and digit sets. Symbols are not filtered by that switch. With uppercase, lowercase, and digits, and ambiguous characters excluded, the set is smaller than 62, so the bit estimate drops for the same length.
What does the bit estimate mean?
Bits are the length times the base-2 log of the set size. They describe the size of the pool, not a promise about a particular website. For length 16 and a set of 62, the estimate is about 95.27. The page shows 95 and the label Strong.
The label uses the estimate before rounding. Under 50 is Short. Under 80 is Moderate. 80 or more is Strong. A Short label means the pool is small for the length you chose. It is not a report that the password was found in a breach.
What should you do with the result?
Each press draws a new password. Do not expect the same string twice. Copy it into a password manager or another store you trust. The generator does not remember the previous value after you leave the page.
The strength checker is a different tool. It rates a password you type, using the kinds of characters it sees. The generator rates the password from the sets you selected before the string exists. Neither page looks up breaches. A hash of the password is a third, separate task.
How to generate a password
- Set the length. Use a whole number from 8 to 64. The default is 16. A blank or a fraction is rejected.
- Select at least one character type. Letters, digits, and symbols can be combined. Turn off a type only if a site refuses those characters.
- Decide whether to drop ambiguous characters. That option removes O, 0, I, l, and 1 so the password is easier to read aloud. It also shrinks the set.
- Generate and store it. Read the set size and the bit estimate, then copy the password into your own store. This page does not keep it.
Example
16 characters, letters and digits
Uppercase, lowercase, and digits, with ambiguous characters still allowed, use 62 characters. Length 16 is about 95.27 bits. The page shows 95 bits and Strong. The password itself is random, so this guide does not print one.
The symbol set
Adding symbols includes !@#$%^&*()-_=+[]{};:,.? and raises the set size above 62 when letters and digits are also on. The bit estimate rises with the set size. Ambiguous filtering does not remove those symbols.
Common mistakes
The label is not a breach check
Strong means the pool estimate is at least 80 bits. It does not mean a site will accept the password, and it does not mean the string is absent from a leak.
A new click is a new password
Do not refresh hoping to see the same value. Copy it before you leave the page.
FAQ
- How long can the password be?
- From 8 to 64 characters. The default length is 16. The length must be a whole number.
- Why does 16 letters and digits show 95 bits?
- That selection uses 62 characters. Length times the base-2 log of 62 is about 95.27. The page rounds the display to 95 and labels it Strong because the estimate is at least 80.
- Which characters count as ambiguous?
- O, 0, I, l, and 1 are removed from the letter and digit sets when that option is on. The 23 symbols stay.
- Will the page show the same password again?
- No. Each generation draws a new string with crypto.getRandomValues. This guide does not publish a sample password for that reason.
- Is the password uploaded?
- No. Generation runs in the browser. The page does not store the password or check a breach list.
To create a random password from the sets you select, use the Password Generator. It stays in the browser.
To rate a password you already have, read How to rate a password.
A hash is a different tool. See How to hash text.