Password Generator
Strong, random passwords created entirely in your browser.
How to create a strong password
A strong password is long and unpredictable. This generator uses your browser’s cryptographically secure random number generator, so every password is genuinely random — and because it runs entirely on your device, nothing you generate is ever sent to us.
- Length beats complexity. A 16+ character password is far harder to crack than a short one, even with symbols.
- Use a unique password per site. That way one breach can’t unlock your other accounts.
- Store them in a password manager rather than reusing or writing them down.
Why length beats complexity
Password strength is measured in entropy — bits of genuine unpredictability. Each character drawn at random from a pool of size N contributes log₂(N) bits, so entropy grows linearly with length and only logarithmically with alphabet size. Adding characters is far more effective than adding symbol types.
A sixteen-character lower-case password is stronger than a twelve-character one with all the symbol gymnastics — and much easier to type on a phone.
| Entropy | Verdict | Use for |
|---|---|---|
| Under 40 bits | Weak | Nothing that matters |
| 50 – 70 bits | Reasonable | Low-stakes accounts |
| 80 – 100 bits | Strong | Email, banking, work accounts |
| Over 120 bits | Overkill by design | Password-manager master key, encryption keys |
Passphrases
Four or five words chosen at random from a large list are both memorable and strong: a 7,776-word list gives about 12.9 bits per word, so six words is roughly 77 bits. The critical word is random — chosen by dice or software, not by you. Human-chosen word sequences follow grammar and association, and crackers exploit exactly that.
Habits that matter more than the password
- Never reuse. Credential-stuffing attacks replay one leaked password across hundreds of sites. Uniqueness limits any breach to a single account.
- Use a password manager. It removes the need to remember or invent anything, and it will not autofill on a lookalike phishing domain.
- Turn on two-factor authentication. An app-based code or a hardware key defeats a stolen password outright. Prefer either over SMS, which is vulnerable to SIM swapping.
- Ignore forced rotation. Current NIST guidance advises against routine expiry, which pushes people towards predictable patterns. Change a password when there is reason to believe it was exposed.
- Treat security answers as passwords. Your mother’s maiden name is public data; store a random string in the answer field instead.
How this generator works
Passwords are produced in your browser using crypto.getRandomValues(), the platform’s cryptographically secure random source — not Math.random(). Nothing is transmitted, logged or stored, and closing the tab destroys the value.
Password generator FAQ
Are these passwords generated safely?
How long should a password be?
What is password entropy?
Are passphrases as secure as random passwords?
Should I change my passwords regularly?
Is it safe to store passwords in a password manager?
Recently used