Secure Password Generator
Cryptographically secure passwords generated locally on your device.
...Parameters
Building a Strong Password
A truly secure password should be completely random, highly complex, and unique for every account. Our Secure Password Generator allows you to enforce uppercase letters, lowercase letters, numbers, and symbols up to 64 characters in length to defeat brute-force attacks. Use bulk mode to generate up to 20 passwords at once for batch provisioning.
Is it safe to generate passwords online?
Standard online generators are risky. ZeroServer is different. We use window.crypto.getRandomValues() to tap into your operating system's hardware-level entropy. The password is generated in your computer's memory and is destroyed the moment you close the tab. It is completely invisible to our servers.
Built and maintained by Meet Shah · Last updated
What this tool is used for
- Creating a unique credential for a service you will only ever reach through a password manager.
- Producing a shared secret for a service account where no human will ever type it.
- Generating a passphrase for something you do have to type or dictate, where length beats symbol soup.
- Replacing a credential that appeared in a breach notification, one site at a time.
- Producing a batch of distinct credentials for seeding a test environment.
How it works in practice
A worked example
You need one credential that will only ever be pasted by a password manager, and one you will have to read down the phone, and you want to know what each is really worth.
Characters length 16, upper + lower + digits + symbols Passphrase 4 words, hyphen separated
jjNP!#jzg=4][#be 104 bits away-push-nest-word 36 bits
Both came out of the browser's cryptographic random source, and the character draw is worth about sixty-eight bits more than the phrase. With all four classes enabled the pool holds ninety-one characters, so each position contributes log2(91), a little over six and a half bits, and sixteen positions come to 104. The word list behind passphrase mode holds 554 unique entries, which is 9.1 bits per word, so four words come to 36. The phrase is the one a person can actually carry in their head, and it is also, by a wide margin, the weaker of the two.
The edge case that catches people
The figure beside a generated password is not the measurement applied to one you type in. Typed passwords are scored on guessability — how cheaply an attacker could describe them out of dictionary words, keyboard walks, dates and repeats — and that is the wrong question to ask of a random draw, because a random draw will now and then contain love or 2020 and get marked down for it. For output of a cryptographic generator the honest number is the entropy of the process, length times the log of the pool size, and that is what you are shown.
When not to use this tool
Four words out of 554 is fine for a guest network and not enough for anything guarding other secrets. Diceware draws from 7,776 words at 12.9 bits each, so matching a six-word Diceware phrase takes eight or nine words here — raise the count, or use character mode, for a master key. And this generates secrets rather than deriving them: turning a password a person chose into an encryption key is work for Argon2 or PBKDF2, where being slow is the whole point.
Frequently Asked Questions
- How long should a strong password be?
- At least 16 characters for general use; 20+ for critical accounts. Each extra character multiplies the brute-force search space exponentially. With a password manager, use 32+ characters — you don't need to memorize them.
- Should I include special characters?
- Yes, if the site allows them. Mixing uppercase, lowercase, digits, and symbols dramatically increases the search space an attacker must explore — especially for shorter passwords under 12 characters.
- What's a passphrase and when should I use one?
- A passphrase is several random words joined together (e.g. correct-horse-battery-staple). It's easier to memorize than a random string while being statistically harder to brute-force at 4+ words. Best for passwords you must type from memory.
- Is the generated password truly random?
- Yes. This tool uses your browser's crypto.getRandomValues() API — the same cryptographically secure entropy source used for TLS key generation. The password is generated in your browser and never transmitted anywhere.
- What does 'exclude ambiguous characters' do?
- It removes visually similar characters like O (capital O) and 0 (zero), I (capital I) and l (lowercase L) and 1. Use this when you need to read the password off a screen and type it into another device.
- Should generated passwords exclude ambiguous characters?
- Only where a human transcribes them. Removing `0`, `O`, `1` and `l` shrinks the character set and therefore the entropy slightly, which is a worthwhile trade for a printed credential and pointless for one stored in a manager.
Common errors and gotchas
- Reaching for maximum complexity on a password you must type by hand, then writing it on a note because you cannot.
- Excluding ambiguous characters and then treating the shortened alphabet as equally strong at the same length.
- Generating a strong password and reusing it. Uniqueness per site is worth more than any amount of extra entropy.
- Trimming a generated password to fit a field limit, which discards exactly the entropy you generated it for.
- Assuming a substitution pattern adds strength. Predictable letter-to-symbol swaps are the first thing a cracker tries.