Password Generator
Generate strong, random passwords with customizable rules.
mqgE:6Ly<dsJ6X$3About the Password Generator
Generate strong random passwords with the character sets and length you choose. Passwords produced here use your browser's cryptographically secure random number generator, so they are genuinely unpredictable rather than merely random-looking.
How to use it
- 1 Set the length — 16 characters or more is a sensible floor.
- 2 Choose which character sets to include: uppercase, lowercase, digits, symbols.
- 3 Click Generate for a fresh password.
- 4 Copy it straight into your password manager.
What it does
- Cryptographically secure randomness via the Web Crypto API
- Configurable length and character sets
- Option to exclude ambiguous characters such as l, 1, O and 0
- Strength and entropy indication
- Generated locally — never transmitted or stored
Frequently asked questions
Is it safe to generate a password on a website?
With this one, yes — generation happens entirely in your browser using crypto.getRandomValues(), and the result is never sent anywhere, logged, or stored. You can confirm this by loading the page and then disconnecting from the network; it keeps working. That said, the safest option of all is your password manager's built-in generator, since it never touches the clipboard.
How long should a password be?
At least 16 characters for anything that matters, and longer for a password manager master password or an account without two-factor authentication. Length contributes far more to strength than complexity rules do — a long random password beats a short one with mandatory punctuation every time.
What is password entropy?
A measure in bits of how hard the password is to guess, calculated from the size of the character set and the length. Each extra bit doubles the work an attacker must do. Below about 60 bits is weak against a determined offline attack; 80 bits or more is comfortable.
Are complex character rules actually useful?
Less than people assume. Forced substitutions like P@ssw0rd1! produce predictable patterns that cracking tools model directly. Current NIST guidance drops composition rules in favour of length and screening against known-breached passwords. Random generation plus length is what works.
Should I reuse a generated password?
Never. Reuse is what turns one site's breach into a compromise of every account you own, through automated credential stuffing. Generate a unique password per site and let a password manager remember them.