Password Generator

This makes a strong, random password right in your browser, and it never leaves the page. Pick the length, pick which character types you want, and you get a fresh one instantly. Nothing gets sent anywhere, nothing gets saved.

Real talk though: if you already use a password manager, it makes passwords for you too. So why use this? Because a handful of passwords shouldn't live inside your manager, or can't. The master password that unlocks the manager itself. A wifi password you have to read out loud to a guest. A code you're setting up on a work laptop where you'll never log into your own vault. A throwaway for a site you'll touch once. That's the gap this fills, and it's what the page is built for.

1. A password shows up the moment the page loads. Hit refresh for a new one whenever you want.
2. Set the length with the slider. This is the single biggest lever you've got. 16 is a fine everyday default, 20 or more for anything that matters.
3. Toggle the character types: lowercase, uppercase, numbers, symbols. All four on gives the strongest result. Only turn one off if a picky site rejects it.
4. Flip on "Exclude look-alikes" if you'll type it by hand or read it aloud. It drops the characters people mix up: capital I, lowercase l, the number 1, capital O, lowercase o, and the number 0.
5. Watch the strength meter. It shows entropy in bits, which is a real measure of how hard the password is to guess, not a vague weak-or-strong label. Reads low? Add length or turn on more types.
6. Copy it, paste it where it needs to go, done.

Heads up: because nothing is stored, the password is gone the second you refresh or close the tab. Copy it somewhere safe before you leave.

Fair question, and worth answering straight. Password managers are great and you should use one. But they can't be the answer for everything.

Take the master password that unlocks your manager. You obviously can't store that inside the thing it unlocks, so you need a strong one made somewhere else. Or a wifi password you're about to read out loud to a house guest, or a PIN you're setting up on a smart TV, where auto-fill isn't an option and you just want a clean random string in front of you. Or you're on a work laptop or a friend's computer where you are never going to sign into your personal vault, but you still need a solid password right now. Or you just want a quick throwaway for a site you'll use once.

That's the gap this fills. The fast, private, no-login option for the passwords that don't belong in your vault, or can't go there yet. Nothing to install, nothing to sign into, and it works with your wifi off.

There's one more thing a manager won't do: hand you a whole pile of passwords at once. If you're seeding a database, spinning up a batch of test accounts, or handing out temporary logins, you can generate up to a million here and export them straight to a text file. That's a job for a generator, not a vault.

Here's where a lot of old advice has it backwards. Everybody remembers the rule about mixing uppercase, lowercase, a number, and a symbol. That does help, but length does far more of the work by a wide margin.

Every character you add multiplies the number of possible passwords, so the number of guesses an attacker would have to try grows enormously with each one. A 16-character password made of nothing but lowercase letters already has more combinations than most attacks can realistically churn through. Add the other three character types and you're way past that. The strength meter shows this as entropy in bits, and every single bit doubles the guessing work. Somewhere north of 70 bits is solidly out of reach for normal cracking, and you get there with length a lot more easily than by cramming symbols into a short password. So if you ever have to choose, make it longer, not weirder.

Some passwords you have to type by hand, on a TV remote, a game console, a phone with a fussy keyboard. Some you have to read aloud, to a coworker or a family member. And that's exactly when it bites you: is that a capital I, a lowercase l, or the number 1? Is that an O or a zero?

Turning on "Exclude look-alikes" removes that whole category of "I typed it right, I swear" frustration by dropping those six confusable characters. You give up a sliver of the character pool, but for anything you'll key in or say out loud, that trade is worth it every time. For a password that lives in your manager and gets auto-filled, leave it off and keep the full set.

A password is a secret. The moment a secret gets sent across the network, or generated on someone else's server, you are trusting that nobody wrote it down along the way. This tool never puts you in that spot. It builds the password right on your screen using a cryptographically secure random generator built into your browser, with zero network requests. You can turn off your wifi and it keeps going. There's nothing to trust here, because nothing leaves your machine.

Reusing one good password everywhere. This is the big one. When a site gets breached and its list leaks, attackers take those same email-and-password combos and try them on your bank, your email, everywhere. It's called credential stuffing, and it works purely because people reuse. A different password per account blocks it completely. That's the actual reason to use a generator, since nobody can invent 80 unique random passwords in their head.

Keeping them in a notes app or a spreadsheet. Get a password manager. That's the whole job it does, and it does it far better than a text file.

Short but "clever." Swapping an a for an @ and calling it a day does almost nothing. "p@ssw0rd" is short and predictable and falls in seconds. Cleverness is not length, and attackers know all the tricks already.

Changing passwords on a schedule for no reason. Forced every-90-days rotation is old advice that security folks have walked back, because it mostly pushes people toward weaker, predictable variations of the same password. Change one when there's an actual reason, like a breach, not because a calendar told you to.