Password Generator
Generate strong, random passwords with your choice of length and character types. Passwords are created on your device with a cryptographically secure generator and are never sent anywhere.
Runs in your browser. Your data is not uploaded.
4–128 characters. 16 or more is recommended.
Generated on your device with the browser’s secure random number generator (crypto.getRandomValues). Nothing is sent or stored.
How to generate a strong password
- A strong password is created as soon as the page loads.
- Adjust the length and choose which character types to include. A new password is generated with every change.
- Select Generate for another password, then Copy to put it on your clipboard.
- Save it in a password manager rather than writing it down.
Features
Cryptographically secure
Uses your browser’s crypto.getRandomValues(), not Math.random(), and avoids bias when picking characters.
Every chosen type included
The password always contains at least one of each character type you select, as many sites require.
4 to 128 characters
From short codes to very long secrets for API keys and encryption.
Avoid look-alikes
Optionally leave out characters such as I, l, 1, O and 0 that are easy to misread.
Strength estimate
See the entropy in bits and a plain-language strength rating.
Never leaves your device
Passwords are generated locally and are not stored, logged or sent anywhere.
Common uses
- Create unique passwords for new accounts
- Replace weak or reused passwords
- Generate Wi-Fi passwords, API keys and temporary codes
Related tools
Frequently asked questions
Is it safe to generate passwords on a website?
This generator runs entirely in your browser. Passwords are created on your device using the secure random generator built into your browser, and are never transmitted, stored or logged.
How long should my password be?
Use at least 16 characters for important accounts. If a site allows it, 20 or more is even better. Length adds more strength than extra symbols.
Should I include symbols?
Symbols increase strength, but some sites reject certain symbols. If a site refuses the password, turn off symbols and increase the length instead.
How is the strength calculated?
Strength is based on entropy: the length multiplied by log₂ of the number of possible characters. This assumes the password is random, which it is when generated here.
Do you store the passwords?
No. The password exists only on this page in your browser. It’s discarded when you leave or reload.
What makes a password strong?
Length matters most. Each extra character multiplies the number of possible passwords, so a 16-character random password is vastly stronger than an 8-character one, even with the same character types.
Randomness matters too. Passwords based on words, names or dates are guessed quickly, even with substitutions like “P@ssw0rd”. Randomly generated passwords have no pattern to exploit.
Finally, use a different password for every account. Then a leak at one website can’t be used to break into your other accounts. A password manager makes this practical.
Understanding entropy
Entropy measures how unpredictable a password is, in bits. Each bit doubles the number of guesses an attacker needs. As a rough guide, under 45 bits is weak, 65 or more is strong for online accounts, and 90 or more resists even large-scale offline attacks.