Password Generator Like LastPass: Free, No Account, In Your Browser
People reach for "password generator lastpass" from two directions. Some have LastPass installed and want the generator that ships with it. Others remember the brand and simply want a strong password fast. Both cases come down to one job: make a random string nobody can guess, then paste it into the account being secured. The LastPass generator lives inside a password manager, so using it means signing in, installing an extension, or both. The generator on this page does the same work as a plain web tool. It runs in your browser, it never asks for an account, and the password it builds is never transmitted anywhere.
What the LastPass generator does, and what a standalone page adds
LastPass builds passwords up to 50 characters in its online tool and up to 100 through its vault, extension, or form fields. The defaults land on 12 characters with upper case, lower case, numbers, and symbols all switched on. Two of its settings are worth knowing: an easy-to-say mode that drops numbers and symbols, and an easy-to-read mode that removes characters people confuse, such as upper-case O against the digit 0, or lower-case l against the digit 1. Every password is measured with the zxcvbn strength library, and the company's own FAQ puts the mark for a strong password at 15 characters or more.
A standalone generator like this one covers the same ground minus the vault. You get a length control that runs further than 50, the same four character types, the same readability tricks under clearer names, and a live strength score. What you do not get is a place to store the result. That is deliberate: the password belongs in whatever manager you already use, and a page that only generates should not keep a copy of it.
The controls on this password generator
The length slider sets anything from 4 to 128 characters and starts at 12, the number most signup forms accept and a reasonable working floor for entropy. The label follows the slider, so the target length is visible before you generate.
Four switches decide the character pool. Upper case adds 26 letters, lower case adds 26 more, digits add 10, and the symbol set adds 26 punctuation marks. Switched on together they give a pool of 88 characters. Turn off the sets a strict form refuses, and the output stays inside its rules.
Two exclusion switches carry the easy-to-read idea. Exclude similar drops the glyphs that look alike in print and on screen: i, l, 1, L, o, 0, and O. Exclude ambiguous removes the punctuation some systems escape, trim, or reject, namely brackets, quotes, backticks, and angle brackets. Neither switch costs much entropy, and both cut the odds of a mistyped password when you have to key it in by hand.
Every result is scored from 0 to 100. A length of 12 or more adds 25 points and 8 to 11 adds 15, while each character type contributes between 10 and 15. Repeated runs, common sequences such as 123 or qwe, and well-worn words pull the score down. The meter prints the specific change it wants, so a weak result tells you whether to add length or another character type instead of simply refusing.
Four presets set everything in one click: Basic at 8 characters with no symbols, Standard at 12 with all four sets, Strong at 16 with both exclusions on, and Maximum at 24 with the same exclusions. Generation runs in JavaScript on your device, and the password appears in a read-only field next to a copy button.
How many bits is a strong password
Password strength has one honest measure: entropy, counted in bits. For a random string, entropy is the length multiplied by the base-2 logarithm of the pool size. Each extra bit doubles the work an attacker has to do.
Pool size grows in steps of characters, not leaps. Lower case alone gives 26 options per position, around 4.7 bits. Adding upper case makes 52 and 5.7 bits. Digits bring 62 and 5.95 bits. The 26 symbols in this generator push the total to 88, about 6.46 bits per character.
| Password shape | Pool | Entropy | Exhausted at 10^12 guesses per second |
|---|---|---|---|
| 8 characters, letters and digits | 62 | 47.6 bits | under 2 minutes |
| 12 characters, letters and digits | 62 | 71.5 bits | about 50 years |
| 12 characters, all four sets | 88 | 77.5 bits | about 3,400 years |
| 16 characters, letters and digits | 62 | 95.3 bits | about 770 million years |
| 16 characters, all four sets | 88 | 103.3 bits | about 200 billion years |
Read the third column against the fourth: small changes in bits move the crack time by orders of magnitude, because time doubles with every bit. The figures assume an offline attack against a fast hash, running at a trillion guesses a second, and they cover the whole search space. A real attack succeeds about halfway through, and an online attempt behind rate limiting is thousands of times slower.
Length beats complexity, in numbers
The useful question is what buys the most entropy for the least effort. Take a 12-character password built from letters and digits, then compare two ways to harden it.
| Change at 12 characters | Entropy |
|---|---|
| Keep letters and digits (62) | 71.5 bits |
| Add one character (13, 62-pool) | 77.4 bits |
| Switch to all four sets (88) | 77.5 bits |
| Add two characters (14, 62-pool) | 83.4 bits |
Adding a single character gains about 5.95 bits. Switching to the full symbol pool gains 6.05 bits at the same length. The two moves are almost equal, and two extra characters beat the symbol upgrade outright. That is why the modern advice runs the other way from the old composition rules.
NIST's digital identity guideline, SP 800-63B, reflects exactly this. Its 2024 revision dropped mandatory complexity rules and periodic password rotation, raised the recommended minimum for a password-only login to 15 characters, and told verifiers to screen new passwords against breach lists instead. Length and randomness first, character variety second.
How to generate a password with this tool
- Set the length to the longest value the service accepts. Sixteen is a good default when the form allows it, and twenty or more suits an account whose password is never typed by hand.
- Leave all four character sets on unless the form rejects something. If symbols are refused, switch the symbol set off rather than trimming characters out by hand.
- Turn on exclude similar when you have to read the password aloud or enter it on a phone. Turn on exclude ambiguous if the form mangles brackets and quotes.
- Press Generate and read the score. A 16-character result from the full pool sits in the strong band. If the meter asks for more length, raise the slider rather than toggling sets back on.
- Copy the password into the account or the manager before generating another. The field is the only place it exists, so a reload loses it.
LastPass generator versus this one
The two tools overlap on almost everything that matters and differ on what surrounds the button.
| LastPass generator | This generator | |
|---|---|---|
| Account needed | yes | no |
| Maximum length | 50 online, 100 in the vault | 128 |
| Character types | upper, lower, digits, symbols | the same four |
| Readability options | easy to say, easy to read | exclude similar, exclude ambiguous |
| Strength check | zxcvbn library | 0 to 100 score with feedback |
| Where the password goes | your LastPass vault | stays in the browser tab |
| Cost | free tool, paid vault tiers | free |
If you already live inside LastPass, its generator is the convenient choice, because the result lands straight in the vault you use. If you want a one-off password and no account, or you use a different manager, this page does the generating and leaves the storing to it.
Mistakes that spoil a generated password
A random password is only as good as its uniqueness. Credential stuffing works because one breached database feeds login attempts against every other service, and a 100-bit password that shows up in a leak is worth no more than a four-digit PIN. Generate a separate password per account and the same setting stays useful for years.
A few habits quietly undo good generation. Adding a digit to last year's password creates no new entropy, because cracking tools guess that transformation first. Mailing a password to yourself, or pasting it into a chat, leaves it somewhere you cannot delete. Storing it in an unencrypted note on a shared device is the same as posting it. Skipping two-factor authentication leaves the account guarded by a single secret, however long that secret is. Where a service offers passkeys, that is a second upgrade worth taking.
FAQ
Is the LastPass password generator free?
The online LastPass tool is free to use, but saving the result needs a LastPass account and its vault. This page is free as well, with no account at all. The trade-off is that it only generates: you keep the password in whatever manager you already trust.
If LastPass recommends 15 characters, how long should I go?
Fifteen is a sensible floor for an account protected by a password alone. Sixteen characters from the full 88-character pool carry about 103 bits of entropy, and this generator goes to 128 for secrets a script will paste into a config file.
Does this generator send my password anywhere?
No. The string is assembled in JavaScript on your device and written into a read-only field. There is no upload step, no account, and no server-side copy. What the page cannot do is protect a device that is already compromised.
Can I copy the easy-to-read option from LastPass?
Yes, under a clearer name. Turn on exclude similar to drop i, l, 1, L, o, 0, and O, the characters most often confused when a password is copied by hand. Turn on exclude ambiguous to remove brackets, quotes, backticks, and angle brackets that some registration forms escape or reject.
What does each character set add to the pool?
Lower case is 26 characters, upper case adds 26, digits add 10, and the symbol set adds 26, taking the pool from 26 to 88. A larger pool adds about one bit per doubling, but each extra character multiplies the whole search space, which is why length usually wins.
Should I reuse a strong generated password on several sites?
No. Reuse turns one breach into many. The moment a service leaks the password, every account that shares it is exposed within hours. Give each account its own string, even if that means a few dozen entries in a manager.
Can I generate more than one password at a time?
The tool draws one password per press. Press Generate again for a new candidate, or reload the page for a clean slate, and copy the one you want before drawing the next.
Why does the strength meter warn about a long password?
It also watches for patterns, not just length. A character repeated three or more times, a run like 123 or qwe, or a common word such as password costs points. Those are the shapes cracking tools try first, so a long but predictable string scores lower than its length alone would suggest.
Pick the account that matters most
The quickest way to use this page: pick the account you would hate to lose, the one with your email, your money, or your work in it, and change its password today. Set 16 characters from the full pool, turn on the exclusion switches if you will ever type it, copy the result, and save it in a manager. Then work through the rest of your logins the next time you sign into them.
Alabama · SO reputation 7991 · Badges: 12🥇45🥈52🥉 · SO member since 2009