Starlight Tools

Strong Password Generator

Create unlimited cryptographically secure passwords locally in your browser. No account is required, and generated passwords are never sent to a server.

Password generator

Your generated password

How this estimate is calculated

The estimate will show the formula, available pool, constraints, and assumptions after generation.

Generate up to 20 results locally. Do not save batches in an unencrypted file.

Character types
Advanced policy settings

Enter exact characters to remove from every enabled set. Use this for a site policy, not to make a password easier to guess.

Only these non-alphanumeric characters are used as symbols. A smaller list reduces the search space.

Policy guarantees

Ambiguous filtering removes o O 0 l i I 1 |. This improves manual entry but slightly reduces the available pool.

The default uses a broad character pool. Restrictions are reflected in the estimate.

Practical presets

Choose a preset to populate the controls and see its trade-off.

How to use the generator

  1. Choose Random Password for a password manager or Memorable Passphrase for something you must type.
  2. Select a preset or adjust only the rules the destination website requires.
  3. Regenerate, then copy the complete result directly into your password manager and the account form.
  4. Use the password for one account only, enable MFA, and choose a passkey when the service offers one.

Password or passphrase?

A long random password is the best default when a password manager will store and fill it. A passphrase is easier to enter manually, but its words must be selected independently by a secure generator—not chosen as a quotation, sentence, or personal story. The fixed separator and fixed capitalization style do not add randomness.

After copying

Save the result in a reputable password manager, verify the website and username, and complete the account change before leaving the page. Avoid email, chat, screenshots, notes, source code, and unencrypted exports. The result remains on screen until it is regenerated or the page is closed or reloaded, and your clipboard may retain it separately.

Recommended settings by use case

Password manager

20 characters with all four types. Strong and broadly compatible when you do not need to type it.

Restrictive website

24 letters and numbers with no symbols. The extra length compensates for the smaller pool.

Manual entry

20 characters without ambiguous look-alikes. Easier to read, with a modestly smaller pool.

Something to remember

Six independently selected words. Store a copy safely even if you plan to memorise it.

Current password security guidance

Length, randomness, and uniqueness matter more than forced composition tricks. Use the longest random password a site accepts: current NIST guidance sets 15 characters as the minimum for a password used as a single authentication factor, while CISA recommends at least 16 characters. This tool’s 20-character default provides a safer margin.

Store every password in a password manager, use a different one for every account, enable MFA, and prefer passkeys where available. Do not change a strong password on an arbitrary schedule; change it when compromise is suspected or confirmed, when it was reused, or when somebody unauthorised may know it.

Methodology and strength estimates

Random-password mode first calculates every string that meets the enabled character sets and minimum counts. It then uses cryptographic random integers and dynamic-programming weights to select uniformly from those valid strings. Character indices are drawn with rejection sampling, which avoids the small bias caused by a simple remainder operation.

The displayed entropy estimate is log2(valid combinations). For an unconstrained password this simplifies to length × log2(pool size). Minimum counts, exclusions, and smaller symbol sets reduce the number of valid combinations and are included. Passphrase entropy counts only random word choices, random capitalization when selected, and optional random digits; fixed separators and fixed case add zero bits.

The offline-guessing range is deliberately labelled as an assumption. It divides the valid combinations by 109 to 1012 guesses per second and is not a promise: real rates vary drastically with storage hashing, attacker access, password reuse, phishing, and implementation. Online services should rate-limit attempts and use modern password hashing.

Frequently asked questions

Is generating a password online safe?

It can be safe when generation happens locally with a cryptographically secure browser API. This page generates results on your device, but you should still use a trusted, updated browser and consider the risks from malicious extensions, screen capture, and clipboard history.

Are generated passwords stored or transmitted?

No. This page does not store generated results or send them to Starlight Tools. Your browser may retain the page in memory, and your operating system, keyboard software, password manager, or extensions may observe clipboard activity according to their own settings.

How does Web Crypto generate passwords?

The generator obtains random values from window.crypto.getRandomValues(). It uses rejection sampling for character and weighted-choice indices so every allowed result is selected without modulo bias. The browser and operating system are responsible for seeding the cryptographic random number generator.

How long should a generated password be?

Use the longest unique password a site accepts. Current NIST guidance uses 15 characters as the minimum for a password used as a single authentication factor, while CISA recommends at least 16; this generator defaults to 20 for a comfortable margin.

Should I use a random password or a passphrase?

Use a random password stored in a password manager for most accounts. Use a passphrase made from several independently selected words when you must type or remember it. In either case, length, randomness, and uniqueness matter.

Are symbols necessary in a strong password?

No. Symbols are useful when a site requires them and can expand the search space, but a sufficiently long, uniformly random password can be strong without symbols. Length and randomness matter more than arbitrary composition rules.

Why must every password be unique?

If you reuse a password, one breached service can expose every other account using it. A unique password limits the damage to one account and lets a password manager identify which login needs changing.

Should I change passwords regularly?

Not on an arbitrary schedule. NIST, OWASP, and the UK NCSC advise against forced periodic changes. Change a password when you suspect compromise, a service reports a breach, the password was reused, or an unauthorised person may know it.

How should I save a generated password?

Save it directly in a reputable password manager and confirm the correct website and username. Do not keep password batches in unencrypted text files, email drafts, chat messages, screenshots, or source code.

What happens after I copy a password?

The result stays visible until you regenerate it, change mode, or close or reload the page. Copying places it on your system clipboard; Starlight Tools does not receive it, but clipboard history, synced clipboards, extensions, or other applications may retain or read it.

Explore more tools