Secure password generator
Random, strong passwords cut on your own device by the browser’s cryptographic random number generator. Nothing you generate is sent anywhere.
Why length beats symbols: the keyspace
A random password is a row of slots. Each slot can hold any character from the pool, so the number of possible passwords is pool size × pool size × …, once per slot. Change the pool and the length and watch which one moves the number more.
A stolen database of unsalted fast hashes, attacked with a multi-GPU cluster. One more character at this pool: 8.2 years.
Going from 62 to 94 characters adds about 0.6 bits per slot. Adding one more slot adds 6 bits or more. That’s why NIST’s guidance (SP 800-63B) stresses length and drops forced symbol rules: every extra character multiplies the work, and a bigger pool only nudges it.
How this generator makes a password
Each character is picked with crypto.getRandomValues, the same operating-system random source browsers use for TLS keys. We use rejection sampling instead of the common random % poolSize shortcut, which would make some characters slightly more likely than others.
The code runs entirely in this tab. There is no server call, no account, and no log of what was generated. You can load the page, switch on airplane mode and keep generating.
What a strong password is
Strength comes from how many guesses an attacker needs, not from how complicated a password looks. Tr0ub4dor&3 looks complex but follows a pattern crackers try early. A 16-character string drawn uniformly from 94 characters has about 105 bits of entropy: at a hundred billion guesses a second, the average search would still take far longer than the age of the universe.
Pick a length for the job
- Stored in a password manager: 20+ characters, all types. You never type it.
- Typed on a TV or console: 16 characters, letters and digits, look-alikes off. Or use a passphrase.
- Your password manager’s master password: a 6–7 word passphrase you can memorise.
- Wi-Fi: see the Wi-Fi password generator, which also makes a QR code.
Need dozens for new accounts? The bulk password generator makes up to 500 at once with CSV export. Want to test one you already use? The strength checker spots the patterns crackers exploit.
The keyspace slider on this page is our small attempt at teaching by doing. ahaboo takes this further, offering free visual explainers that let you understand how something works by adjusting it yourself and watching the result.
Questions people ask
Is this password generator safe to use?
Yes. Passwords are created in your browser with crypto.getRandomValues, the operating system’s cryptographically secure random number generator exposed through the Web Crypto API. Nothing is sent to a server, and the page keeps working if you disconnect from the internet after it loads.
How long should a password be?
For a random password that a password manager stores for you, 16 characters from the full character set gives about 105 bits of entropy, which is out of reach of any known attack. NIST SP 800-63B asks services to accept at least 15 characters when the password is the only factor. Where a site allows it, 20 or more costs you nothing.
Do I need symbols in my password?
Not if the password is long and random. Symbols add less than a bit of entropy per character compared with letters and digits. Turn them off when a site rejects them and add three or four characters of length instead.
What does “avoid look-alike characters” do?
It removes characters that are easy to confuse when reading or typing a password by hand, such as l, 1, I, O, 0 and o. The pool gets slightly smaller, so the tool shows the entropy change live.
Why does the generator guarantee one character of each type?
Many sites reject passwords that are missing a character class. When “one of each type” is on, the generator draws fully random passwords and discards any that miss a selected class, so every character is still uniformly random.
Do you store the passwords I generate?
No. Generated passwords exist only in the page’s memory. The site remembers your settings (length and character types) in your browser’s local storage, never the passwords themselves, and you can clear that on the privacy page.