Home › Security tools › Password generator
Security tool

Generate a strong random password

Passwords are built with your browser’s cryptographic random number generator and never leave this page. Nothing is logged, stored or transmitted, so the result is known only to you.

Perfect for
A new account sign-up Rotating a shared team password A Wi-Fi network key An entry in your password manager Credentials for a staging server
How to use it
1
Set the lengthSixteen characters or more is a sensible default for anything that matters — length is the single largest factor in how long a password survives an attack.
2
Pick the character typesLetters, digits and symbols. If you will have to read the password off a screen or retype it, tick the option that removes lookalike characters.
3
GenerateAsk for a single password, or a batch of up to 20 if you are setting several accounts up at once.
4
Copy and store itCopy the one you want and put it straight into your password manager rather than a notes app.

Options

Every extra character multiplies the search space. Going from 12 to 20 characters helps far more than adding symbols to a short password.

Tip: a password manager plus one unique random password per site beats one clever password that is reused everywhere.

What actually makes a password strong

Strength is a measure of how much guessing an attacker has to do, and guessing is measured in bits: every bit doubles the work. What produces those bits is the size of the pool a character was drawn from, multiplied by how many characters there are. Everything else people believe about passwords — complexity rules, forced rotation, special-character quotas — is a weak proxy for those two numbers.

Length beats complexityAdding two characters multiplies the work by roughly the size of the pool. Adding a symbol to a fixed-length password multiplies it by a fraction of one bit. The two are not comparable.

The arithmetic, laid out

LengthPoolApproximate combinations
8Lowercase only (26)2 × 1011
12Lowercase and digits (36)5 × 1018
16All four sets (85)7 × 1030
20All four sets (85)4 × 1038

Read that table as an attacker would. An eight-character lowercase password falls to a single modern graphics card in minutes. A twenty-character password from the full pool is not reachable by any brute-force approach that is currently practical, regardless of how fast the hardware becomes in the next decade.

Why purely random beats memorable

Substituting letters for numbers — p@ssw0rd — adds almost nothing, because the substitutions are the first thing every cracking tool tries; the patterns are in the dictionaries. A passphrase of four unrelated words does have real entropy, and it is a defensible choice where typing is unavoidable. But for anything a password manager can hold, a long random string is strictly better.

What this page cannot judge for you

  • It cannot tell whether you will reuse the password. Reuse is what turns a minor breach at one site into a compromised identity everywhere. This tool is designed around the assumption that every password is used exactly once.
  • It cannot check whether a password has already appeared in a breach corpus, because that check would require transmitting the password. It does not, and that trade is deliberate.
  • It cannot make the site you are signing up to store your password properly. Length and uniqueness are the two variables genuinely under your control, and they are the two that matter most.
The routine that works: generate a long random password here, let the browser or a manager save it, and never type it again by hand. The only password you need to remember is the one for the manager itself.

Frequently asked questions

Are the generated passwords really random?
Yes. Randomness comes from crypto.getRandomValues, the browser’s cryptographic generator, and characters are drawn with rejection sampling so no character is more likely than any other. Math.random would have been both predictable and subtly biased.
Is this password generator safe to use?
The password is created inside your browser and never transmitted. There is no server-side generation step, no logging and no account, so the only place the result exists is your own screen.
How long should a password be?
Sixteen characters or more for anything that matters — email, banking, work. Length is the strongest single lever: a 20-character password from a mixed pool is many trillions of times harder to guess than a 12-character one.
Should I include symbols?
They help, but only after length. Adding symbols to a ten-character password does less for you than making the same password sixteen characters long. If symbols will make you write the password down, drop them and add length instead.
Why exclude lookalike characters?
O and 0, and l, 1 and I, are nearly identical in many fonts. Removing them makes a password that has to be read off a screen or retyped from a phone far less error-prone, with only a negligible effect on strength.
Are the generated passwords stored anywhere?
No. Nothing is written to storage, cookies or a server. Reloading the page discards them, which is exactly why you should copy a password into your manager before navigating away.