Password Generator
Or use a passphrase
What makes a password strong
Length matters more than anything else. Every character you add multiplies the number of guesses an attacker needs, while swapping an "a" for an "@" barely helps — cracking tools have known that trick for years. A long random string from a password manager beats a short clever one every time.
How this generator works
- Characters come from crypto.getRandomValues, the browser's cryptographic random source.
- Biased draws are discarded rather than folded with a modulo, so every character is equally likely.
- At least one character from each selected set is guaranteed, then the result is shuffled.
- Nothing is transmitted — you can disconnect the network and it still works.
Share this tool with friends
Free to use, no sign-up, works on any phone.
Frequently Asked Questions
They come from crypto.getRandomValues, the browser's cryptographic random source, and the tool rejects biased values rather than using a plain modulo. Math.random is never used, because it is predictable enough to be unsafe for this.
No. It is created in your browser and stays there. Nothing is uploaded, logged or saved, and the tool keeps working with the network disconnected — you can check that yourself in your browser's network tab.
Sixteen characters with mixed types is a sensible floor for an ordinary account, and twenty or more for email and banking, since those can reset everything else. Length adds more strength than complexity does.
It shows entropy in bits, which is how many guesses an attacker would need on average. Under 50 bits is weak, 60 to 80 is reasonable and above 100 is strong against offline cracking.
A passphrase of several unrelated words is easier to type and remember, and can be just as strong when it is long enough. Both options are here — pick whichever you will actually use.