Create strong, random passwords generated securely in your browser.
Set the length with the slider (6 to 32 characters, 16 by default), tick the character types you want, and a new password appears instantly. Use the copy button to grab it or the refresh button to generate another. Nothing is saved, so store the password in your password manager before leaving the page.
Each character is picked at random from the combined pool of the types you select, using your browser's cryptographically secure random number generator. Nothing is sent to a server. The character sets are uppercase letters, lowercase letters, digits, and these 26 symbols: !@#$%^&*()_+-=[]{}|;:,.<>?
Because every character is chosen independently from the whole pool, a given password may occasionally lack one of the selected types, for example no digit. If a site requires all four, just generate another.
Security strength is often described in bits: every extra bit doubles the number of guesses an attacker would need. For a password of random characters, bits = length × log₂(pool size).
| Password | Approx. strength |
|---|---|
| 8 lowercase letters | 38 bits |
| 12 characters, all four types | 78 bits |
| 16 characters, all four types | 103 bits |
| 20 characters, all four types | 129 bits |
The strength meter is a simple guide based on length and variety, not a guarantee. Many security guides suggest at least 12 to 16 characters for important accounts.
Memorable passwords tend to follow predictable patterns (a name, a common word, a birth year), which attackers already account for in cracking tools. A password built from truly random characters resists both guessing and automated attacks far better than a modified word or phrase, even a long one, because there's no pattern to exploit. The tradeoff is that you shouldn't try to memorize it, which is exactly what a password manager is for.
Regular random number functions in many programming languages are predictable if someone can observe enough outputs, which makes them unsuitable for anything security-related. This tool uses the Web Crypto API's crypto.getRandomValues(), the same source browsers use for encryption keys, which is designed specifically to resist that kind of prediction.
| If a site says... | Try... |
|---|---|
| "Special characters not allowed" | Untick symbols, increase length to compensate |
| "Maximum 16 characters" | Set the slider to 16, keep all types ticked |
| "Must include a number and symbol" | Generate again if a symbol or digit happens to be missing |
| "No ambiguous characters" (like 0/O, l/1) | Not filtered here; regenerate if one appears and it matters for handwriting |
This one runs entirely in your browser and makes no requests with your password. As with any tool, avoid pasting the result into places you don't trust.
With 16 characters from a pool of 88, the chance is effectively zero.
Long passphrases made of several random words can also be strong and easier to type. For most accounts, a long random string stored in a password manager is the simplest option.