Password Generator
Create strong, random passwords with full control over length and character sets.
About the Password Generator
The Password Generator creates strong, random passwords that are practically impossible to guess or brute-force. You control the length and exactly which character types to include — lowercase, uppercase, numbers, and symbols — and can optionally remove look-alike characters that are easy to misread. Every password is produced by your browser's built-in cryptographic random number generator (crypto.getRandomValues), the same class of randomness used for real security work, and nothing is ever transmitted or stored.
Weak, reused passwords are the single most common way accounts get compromised. A long, random, unique password for every site defeats both guessing and the credential-stuffing attacks that follow data breaches.
How to use
- A fresh password appears automatically. Click ↻ any time for a new one.
- Set the length with the slider. Longer is stronger — 16 characters is a solid default, and 20+ is recommended for anything important.
- Choose character types. Including all four (lowercase, uppercase, numbers, symbols) gives the largest character pool and the strongest result.
- Turn on "Exclude look-alikes" if you'll be typing the password by hand and want to avoid confusing
I,l,1,O,0, ando. - Click Copy password and paste it into your password manager or the site's signup form.
The strength meter estimates entropy in bits — a measure of how many guesses an attacker would need. As a rough guide: under 36 bits is weak, 60–80 bits is good, and 128 bits is excellent and far beyond what any current attacker can brute-force.
Frequently asked questions
Are these passwords really random and safe?
Yes. They come from crypto.getRandomValues, the browser's cryptographically secure random generator, combined with rejection sampling so no character is more likely than another. This is genuinely unpredictable randomness, not the weak Math.random() used by many web toys.
Is my password sent to a server or saved anywhere?
No. Generation happens entirely in your browser with JavaScript. The password is never uploaded, logged, or stored — not even by us. Once you close or refresh the page, it's gone, so copy it into your password manager right away.
How long should my password be?
Use at least 16 characters for everyday accounts and 20 or more for critical ones (email, banking, your password manager's master password). Length matters more than complexity: a longer password from a big character set is exponentially harder to crack.
Should I use symbols?
If the site allows them, yes — symbols enlarge the character pool and raise entropy. If a particular site rejects certain symbols, turn symbols off and simply add a few more characters of length to compensate.
What does "Exclude look-alikes" do?
It removes characters that are easy to confuse when read or typed: capital I, lowercase l, the digit 1, capital O, and the digit 0 (and lowercase o). This is handy for passwords you'll read off a screen or dictate, at a small cost to the character pool.
Can I trust a password manager with these?
Yes — a reputable password manager is the recommended way to store them. Generate a unique password here (or with the manager's own generator), save it, and let the manager fill it in. You only need to remember one strong master password.
Do you store a history of generated passwords?
No. Passwords are explicitly never saved, synced, or added to any history — by design, because a stored password is a password that can leak.