Password Generator
Generate strong, random passwords instantly.
Something not working, or a feature missing?Report a problem or suggest a tool
How to Use
- 1Choose password length and character types.
- 2Click "Generate".
- 3Copy your new password.
Features
- Cryptographically secure randomness
- Customizable length and character sets
- Password strength indicator
Generate strong, random passwords with customizable length and character sets, using your browser's cryptographically secure random number generator.
What makes a password strong
Strength comes from two things: length and unpredictability. Attackers do not guess passwords one at a time by hand; they run software that tries billions of combinations, starting with common words, names, dates and known leaked passwords. A random password defeats that, because there is no pattern to exploit, and each extra character multiplies the number of possibilities.
| Length | Character sets | Possible passwords |
|---|---|---|
| 8 | lowercase only | about 2 × 10¹¹, which a fast offline attack can crack quickly |
| 12 | upper, lower, digits | about 3 × 10²¹ |
| 16 | upper, lower, digits, symbols | far beyond any practical attack |
| 20 | upper, lower, digits, symbols | far beyond any practical attack |
The generator defaults to 16 characters and lets you choose 6 to 64. Use at least 12 for everyday accounts and 16 or more for email, banking and password-manager master passwords, which protect everything else.
How these passwords are made
Characters are picked using the Web Crypto API (crypto.getRandomValues), the same cryptographically secure source browsers use for encryption keys, not the predictable Math.random. Generation happens entirely on your device. The password is never sent over the network or stored by this site.
Good password habits
- Use a different password for every account. When one site is breached, reused passwords are tried everywhere else.
- Use a password manager to store them. Nobody can remember dozens of random strings, and you should not have to.
- Turn on two-factor authentication wherever it is offered, especially for email.
- Change a password when a service reports a breach, not on a fixed schedule.
- Never share passwords by chat or email. Use your password manager's sharing feature instead.
Some sites reject certain symbols. If a password is refused, untick symbols and increase the length instead; length adds more strength than symbols do.