Password Generator
Create a strong, random password. Choose the length and character types, then copy it — nothing you generate here is ever sent anywhere.
🔒 Generated locally — nothing is uploadedRelated tools
A strong password is really just a string with enough randomness that guessing it isn't practical. This tool builds one from your browser's cryptographically secure random number generator — the same source used for encryption keys — so every character is unpredictable, not pulled from a predictable pattern or a word list.
How this generator works
Behind the scenes this tool uses crypto.getRandomValues(), a browser API built for cryptography rather than Math.random(), which is fast but not designed to be unpredictable. Each character is picked using rejection sampling so every allowed character has exactly equal odds of appearing — no bias toward any letter, digit, or symbol. The password is assembled, displayed, and copied entirely on your device; the page never sends it anywhere, and closing the tab leaves nothing behind.
Length vs. complexity — which matters more
A password's strength is usually measured in bits of entropy — the base-2 logarithm of how many different passwords the generator could have produced, so every extra bit doubles the number of guesses an attacker would need. Every extra character multiplies the number of possibilities by the size of the character pool, while adding a new character type (say, symbols) only adds a fraction of a bit per character. In practice that means a longer password made of just letters and numbers can be far stronger than a short, densely "complex" one. As a rule of thumb: aim for at least 16 characters if the account supports it, and treat length as your primary lever.
Choosing character types
Leave all four character types on unless a specific site restricts them — more available characters means more possible combinations at the same length. "Exclude ambiguous characters" removes lookalikes: I, l, 1, O, o and 0; it's a small trade of randomness for readability, worth turning on only if you expect to type the password by hand rather than copy-pasting or letting a password manager fill it in.
Why every account needs its own password
Reusing a password means a breach at any one site — even an unimportant one — hands an attacker the credentials to try everywhere else. A unique, random password per account removes that risk entirely, but it only works if you have somewhere to keep track of them: a password manager (built into most browsers and operating systems, or a dedicated app) stores and auto-fills them so you never have to remember or retype one.
Frequently asked questions
Is my generated password sent to a server?
No. Generation, display, and copying all happen locally in your browser using its built-in cryptographic random number generator. Nothing you generate here is transmitted, logged, or stored — refreshing the page produces a completely new password with no memory of the last one.
Is this generator actually secure enough for real accounts?
Yes — it uses crypto.getRandomValues(), the same cryptographically secure source browsers use for things like encryption keys, not a predictable pseudo-random function. At 16+ characters with multiple character types enabled, the result is far stronger than anything a person would reliably come up with manually.
Why does the strength meter matter if the password is already random?
Randomness is necessary but length and character variety still determine how many guesses an attacker would need. The meter reflects that combined entropy so you can judge, at a glance, whether the current length and settings are strong enough for a sensitive account.
Should I memorize my passwords instead of using random ones?
For most accounts, no — a password manager is more secure and more convenient than memorizing dozens of passwords, and it removes the temptation to reuse one you can remember. It's worth memorizing just one strong passphrase: the master password protecting that manager.
What does "exclude ambiguous characters" actually remove?
It filters out characters that are easy to confuse when handwritten, read aloud, or displayed in some fonts — uppercase I, lowercase L, the digit 1, uppercase O, lowercase o and the digit 0. It's meant for passwords you'll type manually; leave it off when copy-pasting or using a password manager, since a larger character pool is always stronger.