Password generator
Spin up a strong, unpredictable password in a single click. Everything is generated locally with your device's cryptographic randomness — no server ever sees a character of it.
Tip: a passphrase you can actually remember is often the better choice — try the passphrase generator.
How to make a strong password
Set the length
Drag the slider to the length you need. Longer wins every time — 16 characters or more puts a password comfortably out of reach of brute-force attacks.
Choose the mix
Keep all four character types on for maximum strength, or switch off symbols if a site refuses them. The meter updates the entropy live as you toggle.
Copy and save it
Hit copy, then paste it straight into your password manager. Never reuse it on a second account — one unique password per login is the whole point.
Why generate passwords here
Truly local, truly private
The generator uses the Web Crypto API built into your browser. No password is ever sent over the network, logged, or saved anywhere — close the tab and it is gone for good.
Cryptographic randomness
Every character is drawn from crypto.getRandomValues with rejection sampling, so there is no predictable pattern and no bias toward any character. That is what makes the result genuinely hard to guess.
No strings attached
No email wall, no daily limit, no upsell, and no cookie banner tracking you around the web. Use it a hundred times a day if you like.
What makes a password strong
A password's real defence is not a clever substitution like P@ssw0rd — attackers cracked those tricks decades ago. What actually matters is entropy: the number of equally-likely possibilities an attacker would have to sift through. Entropy is measured in bits, and each extra bit doubles the work required to guess the password.
Length beats complexity
Adding one more character multiplies the search space by the size of the alphabet — far more than swapping a letter for a symbol. A 20-character lowercase password is dramatically harder to break than an 8-character password full of symbols. When a site lets you, reach for length first.
How many bits is enough?
As a rough guide: under 40 bits is trivial for modern hardware, 60 bits resists casual attacks, 80 bits is solid for almost anything, and 100+ bits is future-proof even against a well-funded adversary running billions of guesses a second. The meter above shows exactly where your settings land.
One password per account
The single biggest risk online is reuse. When one service is breached, attackers try that same email-and-password pair everywhere else — a technique called credential stuffing. A unique generated password for every login turns one breach into a contained, single-site problem.
Store them in a manager
You are not meant to memorise a 20-character random string, and you should not try. Generate it here, paste it into a reputable password manager, and let the manager fill it in for you. Reserve the memorable passphrases for the few secrets you truly must type from memory.
Frequently asked questions
Is this password generator safe to use?
Yes. The password is created entirely on your own device using the browser's built-in cryptographic random number generator. It is never transmitted, never stored, and never visible to us or anyone else. You can even disconnect from the internet after the page loads and it keeps working.
How long should my password be?
Aim for at least 16 characters wherever the site allows it. That length, with a mix of character types, produces well over 90 bits of entropy — more than enough to defeat brute-force attacks for the foreseeable future. Shorter is fine only for low-value accounts you do not care about.
What does the entropy figure mean?
Entropy, shown in bits, is a mathematical measure of unpredictability. It is calculated as the password length multiplied by the base-2 logarithm of the character-pool size. Each additional bit doubles the number of guesses an attacker needs, so higher is always better.
Should I turn off symbols or look-alike characters?
Only if a site rejects symbols, or if you will type the password by hand and want to avoid confusing l, 1, I, O and 0. Removing character types shrinks the pool and lowers entropy slightly, so add a couple of characters of length to compensate.
Can I trust a website with my new password?
You never enter an existing password here — you only create new ones, and they stay on your machine. When you do use a generated password, save it in a password manager rather than a note or spreadsheet, and enable two-factor authentication where it is offered.
Does the same password ever come up twice?
In practice, no. With even a modest length and character set there are astronomically many possibilities, so the odds of the generator ever repeating a result are vanishingly small. Each click draws fresh randomness from your device.