Password Generator
Generate secure passwords with cryptographic randomness. Choose length and character sets.
About this tool
This tool generates hard-to-guess random passwords in your browser. You can choose character types (uppercase, lowercase, digits, symbols) and length, and the generated value is never sent anywhere. Here we also cover what makes a password strong and how to use one safely.
Length matters more than complexity
Surprisingly, the biggest factor in password strength is length, not whether it has symbols. Resistance to brute force grows exponentially with each added character. As a guide, use 16 or more characters for important accounts. A long random string is far safer than a short, complex "P@ss1!".
Never reuse passwords
No matter how strong, reusing a password across services is risky. If one place leaks, the same combination is used to break into your other accounts one after another (credential-stuffing). Use a different password per service and let a password manager handle the ones you cannot remember.
Watch for services that reject symbols
Some services allow only certain symbols or cap the length low. If a generated password will not register, drop the symbols or adjust the length. Conversely, a service with an extremely low cap (e.g. 8 characters) is a sign its security design may be questionable.
Handling the generated value
Generation stays in your browser, but be mindful of the display while screen-sharing or in public. And rather than keeping a generated password in a notes app as plain text, store it in a password manager.
How to use
- Choose the length and character sets (lowercase, uppercase, digits, symbols).
- A secure password is generated using cryptographic randomness.
- Use “Regenerate” to make a new one and “Copy” to grab it.
FAQ
Is the generated password stored or sent?
No. Generation happens entirely in your browser; the password is never sent to a server or stored.
Is it truly random?
Yes. It uses the browser’s cryptographic randomness (Web Crypto) to produce hard-to-predict strings.
What is entropy (bits)?
It measures how hard a password is to guess — higher values resist brute force better. Roughly, 70 bits or more is considered strong.
How long should a password be?
It depends on use, but 12–16 characters or more is generally recommended. Longer greatly improves security.
Is it unsafe without symbols?
Dropping symbols reduces the pool and lowers strength, but a sufficiently long password can still be strong in practice. Balance character variety and length.
How should I manage many generated passwords?
To avoid reuse, a password manager is the safest option — register the generated password there directly.