Password Generator
Strong, random passwords — generated in your browser
Free strong password generator — cryptographically secure
Toololis Password Generator creates strong, random passwords using your browser's cryptographic random number generator. No server-side generation, no logging, no storage. Each password is drawn from a uniform random distribution over your chosen character pool.
What makes a password strong?
- Length — Every extra character makes brute-force attacks exponentially harder
- Character variety — Uppercase + lowercase + numbers + symbols multiply the search space
- Randomness — True randomness (not patterns, not words) prevents dictionary attacks
- Uniqueness — A different password per account limits blast radius of any single breach
How to use this tool
- 1
Set a length
Drag the slider or type a number. 12 is the minimum recommended for online accounts. 16+ for banking, 20+ for crypto wallets.
- 2
Pick character types
Toggle uppercase, lowercase, numbers, and symbols. More types = higher entropy. Enable "Avoid look-alikes" to exclude 0/O/1/l/I which are hard to read.
- 3
Click Generate
A new cryptographically-secure password appears instantly. The strength meter shows an estimate — aim for "Very Strong".
- 4
Copy to clipboard
Click Copy and paste into your password manager. The password is generated fresh each time and never stored anywhere.
Password length vs. crack time (offline attack, 1 trillion guesses/sec)
- 8 chars (letters+numbers): ~30 seconds
- 10 chars (letters+numbers+symbols): ~2 months
- 12 chars (letters+numbers+symbols): ~200 years
- 16 chars (letters+numbers+symbols): ~30 billion years
- 20 chars (letters+numbers+symbols): Heat death of the universe territory
Best practices for password security
- Use a password manager (1Password, Bitwarden, KeePass) to store unique passwords per site
- Enable 2FA on email, banking, and social accounts — better than any password alone
- Never reuse passwords between accounts — a single breach compromises all reuse sites
- Rotate high-value passwords every 12 months (email, banking, admin accounts)
- Never share passwords over email or SMS — use Signal or a shared password-manager vault
Frequently Asked Questions
How secure is this password generator?
crypto.getRandomValues() API, which is cryptographically secure. The same API browsers use for TLS key generation. Each password is drawn from a uniform random distribution — no bias, no patterns, no predictability.How long should my password be?
Is the password stored anywhere?
Should I include symbols?
What does the strength meter measure?
log2(characterPool^length) calculation. "Very Strong" (80+ bits) is considered uncrackable by current hardware for centuries.Why avoid look-alike characters?
0 looks like O, 1 looks like l or I. If you ever need to type the password manually (e.g. from a printed note), avoiding these prevents errors. Does slightly reduce entropy.