Password Generator
Create strong, truly random passwords with the options you need, and see exactly how hard each one would be to crack.
🔒 Runs entirely in your browser. Nothing you enter is sent to a server.
Weak and reused passwords are still the most common way accounts get taken over. Humans are bad at randomness. We pick names, dates and keyboard patterns that cracking software tries first. This generator removes the human from the process. It builds every password from your browser’s cryptographically secure random number generator, then shows you how strong the result is.
How to use the password generator
- A new password appears as soon as the page loads.
- Drag the length slider. 16 is a solid default, and longer is always stronger.
- Choose character types. Uppercase, lowercase, numbers and symbols. Each password includes at least one character from every type you select, so it will pass sites with complexity rules.
- Click Copy, then paste it straight into a password manager.
Press ↻ for a fresh password as many times as you like.
What makes a password strong?
Strength comes down to entropy: the number of guesses an attacker would need, written in bits. For a truly random password it is easy to calculate:
entropy (bits) = length × log₂(size of the character pool)A 16-character password drawn from all 89 characters this tool uses has about 16 × 6.46 ≈ 103 bits of entropy. Every extra bit doubles the work for an attacker.
| Entropy | Rating | What it resists |
|---|---|---|
| Under 40 bits | Weak | Cracked in seconds to hours offline |
| 40–59 bits | Fair | OK only for low-value, rate-limited logins |
| 60–79 bits | Strong | Years of offline cracking |
| 80+ bits | Very strong | Beyond any realistic attack |
The crack-time estimate assumes a well-funded attacker making a trillion guesses per second against a stolen password database. That is a deliberately pessimistic scenario.
Length beats complexity
Adding one character to the length increases strength more than adding a whole new character type. A 20-character lowercase-only password (about 94 bits) is stronger than a 12-character password using every type (about 78 bits). That is why modern guidance, including NIST’s digital identity guidelines, focuses on length and checking against lists of breached passwords rather than forcing awkward symbol rules.
Good password habits
- Use a unique password for every account. One breach shouldn’t unlock everything else.
- Store them in a password manager. It can generate, remember and autofill passwords, so you only need to remember one strong master password.
- Turn on two-factor authentication wherever it is offered, especially for email, banking and cloud storage.
- Don’t change strong passwords on a schedule. Change a password when there is a reason to, such as a breach notice.
Frequently asked questions
Are the passwords generated here stored or sent anywhere?
No. Each password is created on your device by your browser's cryptographic random number generator and is never transmitted or saved. Refresh the page and it is gone for good.
How long should my password be?
For most accounts, 16 characters drawn from mixed character types is plenty. For a password manager's master password or full-disk encryption, use 20 characters or more, or a long passphrase you can remember.
Is Math.random() good enough for passwords?
No. Math.random() is not designed to be unpredictable. This tool uses crypto.getRandomValues(), which is the browser's cryptographically secure source, and also avoids modulo bias so every character is equally likely.
Should I avoid look-alike characters?
Turn that option on if you will ever type the password by hand or read it aloud, for example a Wi-Fi password. It removes characters such as O and 0, or l, 1 and I. It slightly reduces strength, so add a character or two to make up for it.