Password Generator
Create strong random passwords with your browser's secure random generator. Choose length and characters, nothing is stored.
The strongest password is one nobody could guess, including you. This generator uses the same secure random source your browser uses for encryption, and the passwords are created on your device, shown once and never stored or sent.
How to use the Password Generator
-
Set the length
Drag the slider. 16 characters is a good default; go longer for very important accounts.
-
Choose characters
Keep upper case, lower case, numbers and symbols on, and avoid look-alikes if you will type it by hand.
-
Copy and save
Copy the password and store it in a password manager straight away.
Features
-
Secure randomness
Uses the Web Crypto random generator with unbiased sampling, not a predictable math function.
-
8 to 64 characters
From quick PINs for low risk sites to very long keys for important accounts.
-
Every type included
Each password contains at least one character from every set you turn on.
-
Avoid look-alikes
Leave out l, 1, I, O and 0 for passwords you need to read or type.
-
Strength estimate
Shows the entropy in bits so you can see how hard it would be to guess.
-
Nothing stored
Passwords are made in your browser and disappear when you close the page.
When to use it
New accounts
Give every account its own password so one leak cannot unlock the rest.
After a breach
Replace a password that appeared in a data leak with a strong new one.
Wi-Fi networks
Create a long Wi-Fi password, then share it easily with our QR Code Generator.
Developers
Generate database passwords, secret keys and test credentials.
What makes a password strong?
Length and randomness. Each extra character multiplies the number of possible passwords. A random 16 character password with all four character types has about 103 bits of entropy, far beyond what any attacker can guess.
Avoid words, names, dates and keyboard patterns. They feel random to us but are the first things cracking tools try.
Passwords, password managers and passkeys
Nobody can remember dozens of random passwords, so store them in a password manager such as the one built into your phone or browser. Where a site supports passkeys, use them: they replace passwords entirely and cannot be phished.
How long would it take to crack?
Attackers who steal a password database can test billions of guesses per second against weak storage. An 8 character password using only lower case letters can fall in seconds in that situation. A random 12 character password with mixed characters takes a very long time, and a random 16 character one is out of reach of any realistic attack.
The weakest point is usually reuse, not length. If the same password protects your email and a small forum that gets breached, attackers will try it everywhere. A unique random password for every account removes that risk.
Frequently asked questions
Is this password generator safe?
Yes. Passwords are created in your browser with a cryptographically secure random generator, and they are never sent, logged or stored.
How long should my password be?
At least 12 characters, and 16 or more for email, banking and anything important.
What does bits of randomness mean?
It measures how many guesses an attacker would need. Every extra bit doubles the work. Above about 70 bits is very strong for online accounts.
Should I use symbols?
Yes when the site allows them. If a site rejects some symbols, turn symbols off and add a few extra characters of length instead.
Can you see my passwords?
No. They are generated on your device and never leave it.
How do I remember random passwords?
You do not need to. Save them in a password manager, which fills them in for you.