About Password Generator

Generate secure random passwords with custom rules. Part of the DevTools Surf developer suite. Browse more tools in the Generators collection.

Use Cases

• New account signups
• API key roots
• Database credential rotation
• Bulk-generate unique dev passwords during onboarding drills

Tips

• Use 16+ characters for strong passwords
• Enable 'Exclude ambiguous' to avoid confusing characters like 0/O and 1/l
• Generate multiple passwords and pick the one you like

Fun Facts

• A 20-character password with mixed case, digits, and symbols would take ~7 octillion years to brute-force at 100 billion guesses per second.
• The most common password in data breaches is still '123456' — used by over 23 million accounts in the 2019 Have I Been Pwned dataset.
• NIST's 2024 guidelines recommend password length over complexity — a 16-character lowercase passphrase is stronger than an 8-character 'complex' password.

FAQ

What character sets are available?

Lowercase, uppercase, digits, symbols — toggle each independently. For contexts that restrict symbols (some financial sites), uncheck symbols. Default includes all four sets.

How long is secure?

16+ characters with all four sets: ~100 bits of entropy, effectively uncrackable. 12 characters is the minimum for anything that matters. 8-char passwords are routinely cracked.

What's 'exclude ambiguous'?

Removes 0/O, 1/l, I, B/8 — characters that look identical in some fonts. Slightly reduces entropy but greatly reduces copy/paste errors.

Can I generate many?

Yes — bulk mode for 100+ passwords. Export as a list for a password manager import or for generating initial credentials during onboarding.