Password generator: when to use it

The Password Generator creates a random password in your browser using the Web Crypto secure random generator. Nothing is uploaded. This guide explains the situations where it saves you from guessable or reused passwords.

Last reviewed: 2026-07-03

freetoolonline.com Editorial Team

Account creation

When you sign up for a new service, you have a clean slate to set a strong password. The generator starts at 16 characters with all four sets - lowercase, uppercase, digits, and symbols - enabled, which gives around 98 bits of estimated entropy. Paste the output into the new-password field and store it in your password manager before you close the tab, since the tool does not save anything between visits.

Password reset

A forced reset is a good moment to move away from a password you have used before. Type in a new one you invented tends to drift back to familiar patterns (dictionary words, birth years, repeated characters). The generator avoids that: each character is chosen with the browser secure random generator, so no personal detail can end up in the output.

Replacing a reused password

Using the same password on two services means one breach exposes both. When you find a reused password, open the generator, set a length of 16 or more, and copy a fresh one into the site you use less often first, then the one you use more often. Because the tool runs entirely in your browser and produces no history, the two passwords are unrelated even if you generate them back to back in the same session.

When a site bans certain characters

Some services reject passwords that contain symbols. Uncheck the symbols box to remove them from the pool, then add a few characters to the length slider to make up the reduced entropy. For example, dropping symbols from a 16-character password cuts roughly 15 bits; bumping the length to 19 restores it. The strength label updates in real time so you can see when you have recovered the lost entropy.

When you are on a shared computer

The generator runs locally and produces no history - refreshing the tab clears the output, and nothing is saved on the page. If you use it on a shared or public computer, copy the password straight to the destination and close the tab. Do not copy it into a plain-text file or leave the tab open.

Reading and typing the password by hand

The lowercase, uppercase, and digit sets skip look-alike characters on purpose: lowercase omits l and o, uppercase omits I and O, and digits omit 0 and 1. If you must read the password off a screen and type it elsewhere (a TV login, for example), that trade makes the password easier to transcribe without misreading a one for an el.

When the generator is not the right choice

A randomly generated password only helps if you store it somewhere safe before closing the tab. If you have no password manager and must memorise the password, a generator output of 16+ random characters is not realistic to remember. In that case a passphrase (four unrelated words, 30+ characters) is easier to recall while still being long. The generator suits cases where a manager handles storage; memory suits cases where it does not.

Companion guides

• Password Generator tool - generate a strong password in-browser with no upload.
• Password generator step by step - walkthrough of every control on the tool page.
• Password generator vs. alternatives - how the in-browser approach compares to typing your own.
• Utility tools hub - the full set of browser-only helpers.

Frequently asked questions

How often should I generate a new password?

Generate a new password whenever you create an account, reset a forgotten one, or find a reused one. Changing strong, unique passwords on a schedule is less important than making sure each account has its own password in the first place.

Is a 16-character password long enough?

With all four character sets on, 16 characters gives around 98 bits of estimated entropy - marked Very strong by the tool. That is more than enough for most accounts. For high-value targets like a primary email or bank, 20 characters adds another 24 bits with no extra effort.

What if the site does not accept the generated password?

Try unchecking the symbols box first, since many sites block non-alphanumeric characters. If the site also caps length, lower the slider to match. Adjust until the site accepts the input, then click Generate to roll a fresh password with those constraints.

Can I use the same generated password on two sites?

No - reusing a password defeats the point. If a breach exposes the shared password, both accounts are at risk. Click Generate once per account and store each password in a manager so you never need to reuse one.