Create strong, random passwords instantly. All generation happens in your browser — nothing is ever sent anywhere.
Customize and generate — click the refresh icon to get a new one
Generate multiple passwords at once with the same settings
Longer passwords are exponentially harder to crack. 16 chars is the minimum for strong security.
Mix uppercase, lowercase, numbers and symbols for maximum entropy.
Use a unique password for each account. A password manager can remember them all.
Two-factor authentication adds a second layer of security even if your password is compromised.
Password strength is not a vibe, it is a count. The only thing an attacker guessing your password cares about is how many possibilities they have to work through, and that number is decided by two things: how many different characters could appear in each position, and how many positions there are. Multiply the first by itself once per position and you have the size of the search space. Security people express this as entropy in bits, where each extra bit doubles the work required.
The consequence is unintuitive but important: length beats complexity. Adding one more character multiplies the difficulty by the size of your character set. Adding a symbol to a short password merely widens the alphabet slightly. The table below shows roughly how many bits of entropy you get from common combinations.
| Character set | 8 characters | 12 characters | 16 characters | 20 characters |
|---|---|---|---|---|
| Lowercase only (26) | 38 bits | 56 bits | 75 bits | 94 bits |
| Upper + lower (52) | 46 bits | 68 bits | 91 bits | 114 bits |
| Letters + digits (62) | 48 bits | 71 bits | 95 bits | 119 bits |
| Letters + digits + symbols (94) | 52 bits | 79 bits | 105 bits | 131 bits |
Read across a row and then down a column. Going from 8 to 16 lowercase characters buys you far more than going from 8 lowercase to 8 mixed-everything characters. As a rough guide, anything below about 50 bits is weak against a determined offline attack, 60 to 80 bits is reasonable for ordinary accounts, and 100 bits or more is comfortable for anything you would be upset to lose.
The entropy figures above only hold if every character really is chosen at random. Human-invented passwords are not random, and cracking tools are built specifically around that fact. Substituting characters in a dictionary word, the trick that turns "password" into "P@ssw0rd", adds almost nothing, because every cracking wordlist has applied those same substitutions for over two decades. The same is true of appending a year, capitalising the first letter, or adding an exclamation mark at the end. These are the first transformations an attacker tries, not the last.
Patterns drawn from your own life are worse still. Names of family members and pets, birth dates, vehicle registrations, favourite teams and phone numbers are all recoverable from social media and data breaches, and targeted attacks start there. A password only has the strength of the process that produced it, which is why generated passwords are worth using even though they are impossible to memorise.
Not all randomness in a browser is equal. The familiar Math.random() function is designed for speed in games and animations, is not cryptographically secure, and can be predictable if an attacker can observe enough output. This generator instead uses the Web Crypto API's crypto.getRandomValues(), which draws from the operating system's cryptographically secure random source, the same pool used for generating encryption keys.
Characters are also selected in a way that avoids modulo bias. Naively taking a random number and dividing by the alphabet size makes the earliest characters in the set very slightly more likely than the last ones, which shaves a small amount off real entropy. Rejecting and re-drawing values that would fall outside a clean range keeps the distribution genuinely uniform.
There is one category of password you can both remember and defend: a passphrase built from several unrelated words chosen at random. Four or five randomly selected common words produce a string that is long, easy to type on a phone and surprisingly strong, because the entropy comes from the unpredictability of the word choice rather than from strange characters.
The catch is the same as before. The words have to be chosen randomly, not composed by you. A phrase you invented because it felt random is drawn from a much smaller pool than you think. Passphrases are best for the handful of passwords you genuinely have to type from memory, such as your device login and your password manager's master password. Everything else should be a long generated string you never see.
A generated password is only useful if you can retrieve it. The realistic options are a reputable password manager, or your browser's or operating system's built-in credential store. Both remove the temptation to reuse a password across sites, which matters because credential stuffing, where attackers replay username and password pairs from one breach against other services, remains one of the most effective attacks in existence. Reuse turns a single unrelated breach into a compromise of everything.
Two habits are worth dropping. Forced periodic rotation without any sign of compromise mostly produces predictable increments and is no longer recommended by major security guidance. And security questions asking for your mother's maiden name or first school are simply weak passwords with public answers; treat them as another random string and store the answer alongside the password.
The strength indicator on this page estimates entropy from the length and the character sets you have enabled. That estimate is accurate for a genuinely random string, which is what the generator produces. It is much less meaningful if you type your own password into a strength meter anywhere on the web, because no meter can tell whether your word appears in a cracking dictionary or was reused from a site that has already been breached. A meter measures shape, not history. Treat a high score on a self-invented password as a weak signal.
A password generator that sends its output to a server is a contradiction, so this one does not. Every password is produced in your browser by your own device's random number generator. There is no network request when you click generate, no logging, no analytics event carrying the value, and no copy retained anywhere after you close the tab. You can verify this by opening your browser's developer tools, switching to the network tab and generating as many passwords as you like while it stays empty. The page also continues to work with your connection disabled, which is the simplest proof that nothing is being transmitted.
Length matters more than symbols. Sixteen random characters is a sensible default for ordinary accounts, and twenty or more for anything valuable such as email, banking or a password manager master password. Going from eight to sixteen characters increases the difficulty far more than adding a symbol to a short password.
For anything stored in a password manager, a long random string is the stronger choice because you never have to remember it. A passphrase of several randomly chosen unrelated words is better for the few passwords you must type from memory, such as your device login. The important part in both cases is that the choice is random rather than invented by you.
No. Substitutions like turning an o into a zero or an a into @ have been built into password cracking wordlists for decades, so they add almost nothing. The strength has to come from genuine randomness and length, not from disguising a dictionary word.
It uses the Web Crypto API's crypto.getRandomValues(), which draws from your operating system's secure random source, rather than the ordinary Math.random() function that is designed for speed and is not suitable for security. Characters are also selected in a way that avoids modulo bias so the distribution stays uniform.
No. Generation happens entirely in your browser. No password is transmitted, logged or saved, and the page keeps working with your network disconnected, which you can confirm by watching your browser's network tab stay empty while you generate.
Routine rotation on a schedule is no longer recommended by mainstream security guidance because it tends to produce predictable variations. Change a password when there is a reason to, such as a breach notification or a shared credential, and focus instead on using a unique long password per site with multi-factor authentication enabled.
We use cookies for analytics and to show ads (Google Analytics & AdSense). Your files are never uploaded — only standard cookies are used. See our Privacy Policy.