Password Generator

Strong passwords built with your browser's cryptographic random generator. They never leave this tab.

Include

What this tool does

It draws characters from the sets you enable using crypto.getRandomValues, the browser's cryptographically secure random source — not the ordinary random function, which is predictable and unsuitable for secrets.

The password is generated in your tab and shown only to you. There is no server involved, nothing is logged, and closing the page destroys it.

Choosing a length

LengthSuitable for
12 charactersLow-stakes accounts, with all four character types
16 charactersA sensible default for most accounts
20+ charactersEmail, banking, password manager master key

Length matters more than complexity. A long password drawn from a smaller alphabet beats a short one crammed with symbols, and it is far easier to type on a phone.

Using passwords well

  • Never reuse a password across sites — reuse is how one breach becomes ten.
  • Store them in a password manager rather than a notebook or a browser autofill you never review.
  • Turn on two-factor authentication wherever it is offered; it protects you even if the password leaks.
  • Change a password when a service announces a breach, not on a fixed schedule.

Common questions

Is the password sent anywhere?

No. It is generated in your browser and never transmitted or stored.

How random is it really?

It uses the browser's cryptographic random generator, the same class of source used for encryption keys.

What do the bits mean?

Bits of entropy — a measure of how many guesses an attacker would need. Above 80 bits is strong for any normal account.

Should I avoid look-alike characters?

Turn that on if you will read the password aloud or type it from paper. Otherwise leave it off, since removing characters slightly reduces strength.

Can I generate several at once?

Press the generate button again for a new one — each press produces a fresh password.