Password Generator
Create strong, random passwords — generated locally, never sent anywhere.
Updated
What Makes a Password Strong?
Two things: length and unpredictability. Every extra character multiplies the number of guesses an attacker needs, which is why a random 16-character password is enormously stronger than a clever 8-character one. Security researchers measure this as entropy, in bits — each added bit doubles the search space.
| Entropy | Rating | Practical Meaning |
|---|---|---|
| Under 40 bits | Weak | Crackable quickly with modern hardware |
| 40–59 bits | Fair | Resists casual attacks, not determined ones |
| 60–79 bits | Strong | Fine for most accounts |
| 80+ bits | Excellent | Effectively uncrackable by brute force |
Practical Password Rules
Use a unique password for every account — reuse is how one breached site compromises your others. Use a password manager so you only memorize one master passphrase. Turn on two-factor authentication for email and banking. And length beats complexity: a 20-character password with only letters is stronger than 10 characters of keyboard confetti.
How This Generator Works
Passwords are generated entirely in your browser using the Web Crypto API (crypto.getRandomValues) — a cryptographically secure random source. Nothing you generate here ever leaves your device.
Frequently Asked Questions
How long should a password be?
At least 12–16 characters for important accounts. Length is the biggest single factor in password strength — each extra random character multiplies the difficulty of guessing it.
Is it safe to generate a password online?
It is here: this generator runs entirely in your browser using the Web Crypto API, and no password is ever transmitted or stored. If you're unsure about any online tool, generating passwords inside a password manager is always a safe choice.
Should I use symbols in my password?
They help by enlarging the character set, but length matters more. A 20-character letters-and-digits password beats a 10-character one full of symbols. Some sites restrict symbols, so letters + digits at greater length is a practical fallback.
How often should I change my passwords?
Modern guidance (including NIST) says don't rotate on a schedule — change a password when there's a reason: a breach, suspected compromise, or accidental sharing. Focus instead on uniqueness per site and two-factor authentication.