Password Generator
Create strong random passwords with your browser's cryptographic random number generator. Passwords are generated on your device and are never stored or sent anywhere.
How to generate a secure password
Choose the length. 16 characters or more is a good default for most accounts.
Select the types of characters to include. Some sites don't accept certain symbols; untick Symbols if a site rejects the password.
Copy the password and paste it into the site or, better, straight into your password manager. Use Generate new if you want a different one.
Recommended settings
Everyday online accounts
16 characters with all four character types. Store it in a password manager so you never need to remember it.
Wi-Fi network key
20 or more characters, letters and numbers, with ambiguous characters excluded so it is easy to type on a TV or a console.
Master password
This is the one password you must remember. A long passphrase of several random words is easier to memorize than random characters of the same strength.
Sites with strict rules
If a site limits length or symbols, use the maximum length it allows and keep as many character types as it accepts.
How the generator keeps passwords secure
Every character is chosen with crypto.getRandomValues, the cryptographically secure random number generator built into your browser. Ordinary random functions such as Math.random are predictable and are never used.
Choosing a character by taking a random number modulo the size of the alphabet would make some characters slightly more likely than others. The generator avoids this bias with rejection sampling: random values that would skew the result are discarded and drawn again. It also places at least one character of each type you select and then shuffles the result, so the guaranteed characters don't sit in predictable positions.
The strength indicator estimates entropy, the number of bits an attacker would have to guess, from the length and the number of possible characters. It is a guide for randomly generated passwords like these, not a measure of passwords chosen by people. Generation happens only on your device: passwords are not stored, logged, sent to our servers or included in analytics.
Frequently asked questions
Are the passwords saved or sent to a server?
No. They are created in your browser and exist only on this page. Reloading or closing the page discards them. We never receive, store or log them.
How long should my password be?
For online accounts, at least 12 characters, and 16 or more is better. Length increases strength faster than adding symbols, so when a site allows it, make the password longer.
What does entropy mean?
Entropy measures how unpredictable a password is, in bits. Each extra bit doubles the number of guesses needed. A 16-character password using all four character types has about 104 bits of entropy.
Why exclude ambiguous characters?
Characters such as I, l and 1 or O and 0 look alike in many fonts. Excluding them helps when you have to read a password aloud or type it by hand, at the cost of slightly less entropy per character.
Should I reuse a strong password on several sites?
No. If one site is breached, a reused password exposes every other account that uses it. Use a different password for each site and keep them in a password manager.