Password Generator
Create strong, random passwords with a tap. Everything is generated locally in your browser using your device's secure random source — nothing is sent anywhere.
New to this? Read the Password Generator guide →
Your password is generated entirely on your device.
How to use the password generator
- Set the length. Longer is stronger; 16+ characters is a good default, and there is rarely a reason to go shorter than 12.
- Choose which character sets to include (uppercase, lowercase, digits, symbols). More variety adds strength per character.
- Press generate, then copy. Every password is produced locally with your browser's cryptographic random source, so nothing is generated on or sent to a server.
Why length beats complexity
A password's strength is measured in bits of entropy, which grow with both length and the size of the character set, but length is the bigger lever. Each extra character multiplies the number of possibilities, so a long password from a smaller set usually beats a short one stuffed with symbols. A predictable "complex" password like P@ssw0rd! is weak because attackers test those exact substitutions first; a long random string has no such pattern.
Random password or passphrase?
For anything stored in a password manager, use a long random password from this tool, since you never have to type it. For the few you must memorise, such as your manager's master password or a laptop login, a five or six word random passphrase is both strong and rememberable.
Good habits
- Never reuse passwords. Reuse is the biggest real-world risk: one leaked site exposes every account sharing that password. A unique password per site matters more than exotic symbols.
- Use a password manager to store the long random passwords this tool creates.
- Turn on two-factor authentication where you can; it defends an account even if the password leaks.
- Check before you trust. See roughly how long a password would survive an attacker in the password strength checker.
Where you'd use this
Creating a credential a human will never memorise and never should: a database user, a service account, a shared admin login going straight into a password manager.
For example: A Postgres role needs a password that survives being pasted through a YAML config and a shell command. A 32-character alphanumeric string avoids the quoting problems that $ and ! cause, while still being far beyond brute force.
Frequently asked questions
What makes a strong password?
Length matters most — aim for 16 or more characters mixing upper- and lower-case letters, numbers and symbols. A long random password is far harder to crack than a short complex one.
Are the generated passwords truly random?
Yes. They are created using your browser’s cryptographically secure random generator, not a predictable algorithm, so each password is unique.
Are the passwords sent over the internet?
No. Passwords are generated locally in your browser and never transmitted or stored, so they are safe to use immediately.