Password Generator

What this tool does

It creates passwords that no one has to remember, because the whole point of a strong password is that a person did not invent it. You set the length and which character types to include; your browser’s cryptographic random number generator does the rest.

Nothing generated here leaves your device. There is no server call, no logging, and nothing is written to local storage — refresh the page and the password is gone for good. Copy it into your password manager before you navigate away.

How to use it

1. Set a lengthSixteen characters is a sound default. Longer is better, and costs you nothing when a password manager is doing the typing.
2. Choose the character typesAll four on is strongest. Turn symbols off only when a site refuses them.
3. Copy itClick the password or the Copy button, then paste it straight into your password manager.

Where the randomness comes from

This matters more than any other detail on the page. The generator uses crypto.getRandomValues(), the browser’s cryptographically secure random source — the same one used to generate TLS session keys. It does not use Math.random(), which is fast, predictable, and completely unsuitable for anything security-related: given a handful of its outputs, its future outputs can be reconstructed.

The character selection is also rejection-sampled rather than taken modulo the alphabet size. Simply doing random % 62 makes some characters marginally more likely than others, because 256 does not divide evenly by 62. The bias is small, but it is free to eliminate, so it is eliminated.

Length beats complexity

Every extra character multiplies the number of possible passwords by the size of the alphabet. Adding one character to a 62-character alphabet multiplies the search space by 62 — far more than swapping an a for an @ ever will.

Anything above roughly 80 bits of entropy is beyond brute force with any foreseeable hardware. Beyond that point, the risk to your account is no longer the password’s strength — it is reuse, phishing, and breaches at the other end.

How the crack-time estimate works

The figure shown assumes an offline attack at a trillion guesses per second against a stolen password database — a deliberately pessimistic scenario. An online attack against a live login form is thousands of times slower, because the server rate-limits attempts.

The estimate is exact for these passwords in a way it never is for human-chosen ones. Because each character is drawn independently at random, the entropy is genuinely length × log₂(alphabet size). A password a person invented has vastly less entropy than its length implies, because people reuse patterns: a capital at the start, a digit and an exclamation mark at the end, a dictionary word in the middle. Cracking tools model those patterns directly.

Use a password manager

A generator only helps if every account gets a different password, and no one can remember thirty random strings. A password manager — the one built into your browser is a perfectly reasonable start — solves this properly. You then remember exactly one strong passphrase, and everything else is unique, long and random.

Then turn on two-factor authentication wherever it is offered. It is the single most effective protection available, because it holds even when a password has already been stolen or phished.

What we can and cannot promise

This page performs no network requests to generate a password, stores nothing, and logs nothing — you can verify that in your browser’s network tab, or by disconnecting from the internet and watching it keep working. What it cannot do is vouch for the device you are on. If your computer is compromised by malware, no web page can protect what you copy to your clipboard. For very high-value credentials, generate them inside your password manager on a device you trust.

Frequently asked questions

Related tools

See everything in All tools. If there’s a generator you’d find useful, let us know.