Strong Password Generator

Generate a strong random password using your browser cryptographic random number generator. Nothing is sent anywhere.

 

About the password generator

Passwords generated here use `crypto.getRandomValues`, the same cryptographically secure source browsers use for encryption keys, rather than `Math.random`, which is predictable and unsuitable for secrets. You control length and which character sets are included, and the strength meter shows the actual entropy in bits so you can see the difference a few extra characters makes. The page makes no network requests after loading, so a generated password cannot leave your device.

How to use the password generator

  1. Set the password length. 16 characters or more is a sensible default for accounts that matter.
  2. Choose which character sets to include: uppercase, lowercase, numbers and symbols.
  3. Optionally exclude look-alike characters such as l, 1, O and 0 if you will be typing the password by hand.
  4. Click Generate, then copy the password straight into your password manager.

Frequently asked questions

Is it safe to generate a password on a website?
It depends entirely on where the generation happens. This tool generates passwords in your browser using the Web Crypto API and makes no network request afterwards, so the password never exists anywhere except your device. A generator that produced passwords on a server would be a bad idea, because the server would see every password it created.
How long should a password be?
For accounts that matter, 16 characters or more with mixed character sets. Length contributes more to strength than complexity does: a 20-character lowercase password is far harder to crack than an 8-character password with symbols scattered through it.
What does the entropy figure mean?
Entropy in bits measures how many guesses an attacker would need on average. Each additional bit doubles that number. Below 50 bits is weak, 60 to 80 bits is reasonable for most accounts, and above 100 bits is beyond brute force for the foreseeable future.
Should I use a different password for every account?
Yes, and this is the single highest-impact security habit there is. When a service is breached, attackers try the leaked credentials everywhere else. A password manager makes unique passwords practical, since you only need to remember one.