Free tool · GENERATE
Strong Password Generator
Make a random password in one click. Choose the length and character types, copy it, and save it somewhere locked.
Runs 100% in your browser. Nothing you type or upload is sent anywhere or stored.
Very strong · about 129 bits of entropy
Generated with crypto.getRandomValues on your device. The password is never sent, logged or saved by this page.
How it works
A strong password is long, random and used on one account only.This generator picks every character with your browser's cryptographic random number generator (crypto.getRandomValues), the same source used for encryption keys. It never uses Math.random, which is predictable.
When you change a setting, the tool builds a new password that includes at least one character from every type you selected, then shuffles it so those characters are not in fixed positions. The meter shows the entropy: length multiplied by log2 of the number of possible characters. 20 characters from the full set gives about 128 bits.
Good habits
- Never reuse a password. One breach then unlocks every account that shares it.
- Prefer length over complexity. Going from 12 to 16 characters beats adding symbols.
- For passwords you must remember, a diceware passphrase is easier to type and just as strong.
- Turn on two-factor authentication, and keep the backup codes offline.
Nothing you generate here leaves the page. There is no server step, no logging and no analytics on the output, so the only copy is the one you paste.
Read more: Is it safe to store passwords in a notes app?, Alternatives to 1Password.
Questions
Use at least 16 random characters for accounts that matter, and 20 or more for your email and password manager. Length adds far more strength than symbols do. A random 16-character password with letters, numbers and symbols has roughly 100 bits of entropy, which is out of reach for any realistic attacker.
It is safe when the generator runs entirely in your browser and uses a cryptographic random source. This one uses crypto.getRandomValues, makes no network request with the result, and stores nothing. You can load the page, turn off Wi-Fi and it still works.
Entropy measures how many guesses a random password could take. Each extra bit doubles the work. 40 bits falls quickly to an offline attack, 60 bits is decent for low-value sites, and 80 bits or more is strong for anything.
Turn that option on if you will ever type the password by hand or read it aloud, for example a Wi-Fi password. It removes characters like 0 and O or 1 and l. It slightly shrinks the character pool, so add a couple of characters of length to compensate.
