Password Generator
Create strong, random passwords in your browser. Cryptographically secure, no sign-up, nothing is sent anywhere.
How to use this password generator
- Drag the slider to choose a length. 16 characters or more is recommended for important accounts.
- Tick the character types you want to include.
- Optionally exclude ambiguous characters or disallow repeats.
- Click Generate for a new password, or Copy to place it on your clipboard.
What makes a strong password?
- Length matters most. Every extra character multiplies the search space. 16+ characters is a solid minimum for important accounts.
- Use all four character types. Upper, lower, digits and symbols together give the largest alphabet.
- Never reuse. Every account should have a unique password, so a leak on one site cannot unlock others.
- Use a password manager. Store passwords in a manager rather than trying to memorise them.
- Enable two-factor authentication wherever it is offered.
How strength is calculated
Strength is based on entropy, measured in bits: entropy = length × log₂(alphabet size). Roughly:
- Under 40 bits — weak, crackable quickly
- 40–60 bits — moderate, fine for low-risk accounts
- 60–80 bits — strong
- 80+ bits — very strong
Randomness comes from the browser's Web Crypto API (crypto.getRandomValues()), which draws from the operating system's cryptographically secure random source — not from Math.random().
Frequently asked questions
Is this password generator safe to use?
Yes. All generation happens in your browser using the Web Crypto API. Nothing is sent to us or stored.
What is a good password length?
16 characters or more for important accounts. 20+ for high-value accounts. Length has more effect on security than complexity.
Should I use symbols?
Yes — they expand the alphabet and increase entropy. The only exception is when a specific site forbids them.
Can I use these passwords offline?
Yes. Once the page loads, the generator works entirely offline. Disconnect your network and it still generates passwords.
Is anything stored?
No. Nothing you generate or type is sent to or stored on our servers.