🔐 Password Generator
Create strong random passwords with full control over the rules.
Options
Generate several at once
What makes a password strong
Length matters more than anything else. A 16-character password made of lowercase letters is far harder to crack than an 8-character one packed with symbols. Every character you add multiplies the number of possibilities an attacker has to work through.
The second thing that matters is randomness. "P@ssw0rd123!" ticks every character-type box and is still one of the first things any cracking tool tries, because it follows a predictable human pattern. A password chosen truly at random has no such pattern.
How this generator works
Passwords are built using your browser's crypto.getRandomValues() — the same cryptographically secure random source used for encryption keys, not the ordinary Math.random(), which is predictable and unsuitable for security.
The character selection uses rejection sampling, which avoids the subtle bias that a naive modulo operation introduces. The final password is then shuffled so the guaranteed one-of-each-type characters are not always at the start.
Nothing is sent over the network. The password exists only in your browser tab until you copy it.
How long should my password be?
- 8 characters — no longer adequate for anything that matters. Modern hardware can exhaust this quickly.
- 12 characters — a reasonable minimum for ordinary accounts.
- 16 characters — a good default. This is what the tool starts with.
- 20+ characters — appropriate for email, banking, and your password manager's master password, since those protect everything else.
The entropy figure under the strength bar is the honest measure. Under 40 bits is weak, 60–80 is solid, and above 80 is comfortably beyond brute force for the foreseeable future.
Use a password manager
A strong password you cannot remember is only useful if something else remembers it for you. That is what password managers are for. Generate a long random password for every account, let the manager store them, and remember exactly one strong passphrase to unlock it.
Reusing one password across sites is the single most common cause of account compromise — when any one of those sites is breached, every account sharing that password is exposed.
Also turn on two-factor authentication
Even a perfect password can be stolen through a phishing page or a keylogger. Two-factor authentication means a stolen password alone is not enough. An authenticator app is meaningfully safer than SMS codes, which can be intercepted through SIM-swap attacks.
Are the passwords stored or logged?
No. They are generated in your browser and never transmitted. We could not see them even if we wanted to. Reloading the page discards everything.
Why exclude look-alike characters?
Because 0/O and 1/l/I are easy to confuse. Tick that option if you will ever type the password by hand or read it aloud. Leave it off for passwords that live in a password manager.
Can the same password be generated twice?
Theoretically yes, practically no. A 16-character password from the full character set has more combinations than there are atoms in the observable universe.
Should I change my passwords regularly?
Current guidance from NIST says no — forced routine changes push people toward weaker, predictable variations. Change a password when you have reason to believe it was exposed.