Password Generator
Strong random passwords generated on your own device using your browser's cryptographic randomness.
How to use it
- Set the length — 16 characters or more is a sensible floor for anything that matters.
- Choose which character types to include, and skip look-alikes if you will be typing it by hand.
- Click any password in the list to copy it straight to your clipboard.
Length beats cleverness, every time
The advice most people absorbed — a capital, a number, a symbol — came from a 2003 guidance note whose own author later said he got it wrong. It produces passwords that are hard for humans to remember and barely harder for a computer to guess.
What actually defeats a guessing attack is length. Each extra character
multiplies the number of possibilities, so a long password made of ordinary
characters beats a short one bristling with symbols. P@ssw0rd!
is short and sits in every cracking dictionary ever assembled. Sixteen
random characters does not.
The strength meter here reports entropy in bits, which is the honest measure: how many guesses an attacker would need. Each extra bit doubles that number. Under 50 bits is weak, around 70 is comfortable for most accounts, and 100 or more is beyond any realistic attack.
Generating one is the easy half
A random password you cannot remember is only useful if something else remembers it for you. That is what a password manager is for, and using one is the single biggest improvement most people can make to their security. It removes the real problem, which is not weak passwords so much as the same password on forty sites.
When one of those sites is breached — and sites are breached constantly — attackers take the leaked list and try it everywhere else. A unique password per site turns a disaster into an inconvenience. Turn on two-factor authentication wherever it is offered, and treat the email account that can reset all the others as the one that matters most.
Frequently asked questions
Are these passwords really random?
Yes. They come from crypto.getRandomValues, your browser's cryptographic random number generator — the same source used for HTTPS keys. Math.random() is not used, because its output can be predicted.
Is the password sent anywhere?
No. It is generated on your device and exists only in that browser tab. It is not logged, stored or transmitted. Nothing here can see it.
How long should my password be?
For a random password from a mixed alphabet, 16 characters is strong and 20 or more is very strong. Length beats complexity — a longer password with fewer symbol types is harder to crack than a short one full of punctuation.
What is entropy in bits?
A measure of how many guesses an attacker needs. Each extra bit doubles that number. Under 40 bits is crackable quickly; over 80 bits is beyond reach of current hardware.
Should I reuse one strong password everywhere?
No. One leaked site then exposes all your accounts. Use a password manager to store a different generated password per site — you only need to remember the one that unlocks the manager.