Password Generator
Create strong, random passwords in one click.
How to use the Password Generator
- Choose a length and which character types to include.
- Click Generate.
- Copy your new password.
About the Password Generator
Every password here is generated in your browser with crypto.getRandomValues(), the Web Crypto API’s cryptographically secure random source. That matters: the ordinary Math.random() most scripts reach for is a predictable pseudo-random algorithm, reproducible by anyone who learns its internal state, and it is not safe for passwords. Nothing is sent anywhere and nothing is logged — load this page, disconnect from the internet, and it still works.
Length beats complexity. Each added character multiplies the possibilities by the size of the character set, so strength grows exponentially with length but only linearly with cleverness. With every type ticked the pool is 87 characters — 26 uppercase, 26 lowercase, 10 digits, 25 symbols — making a 16-character password one of 87 to the power of 16. That is why a long, boring password beats a short one with symbols smuggled in, and why P@ssw0rd! is weak: it is short, and those substitutions are the first an attacker tries.
The honest advice this tool cannot give you by itself: use a password manager, and a different password on every site. Random passwords are only strong while they stay unique — reuse is what turns one company’s breach into an attacker reading your email. For tokens or API keys rather than passwords, use the random string generator.
Frequently asked questions
Are these passwords actually random?
Yes. They come from crypto.getRandomValues(), the browser cryptographically secure random source, rather than Math.random(), which is predictable and unsuitable for anything security-related.
Is my password sent anywhere?
No. It is generated entirely by JavaScript running in your browser. There is no network request, nothing is logged or stored, and once you close the tab the password is gone.
How long should my password be?
Sixteen characters with a full character set is a sensible default and is where this tool starts. Longer is genuinely stronger, because every extra character multiplies the number of possibilities. If a site allows more length, prefer that over hunting for exotic symbols.
Is one of each character type guaranteed?
No. Characters are drawn independently from the combined pool, so a short password could happen to contain no symbol at all. If a site insists on one of each, generate again or edit the result by hand.
Should I memorise the passwords I generate?
No — that is what a password manager is for. Generate a unique random password for each site and let the manager remember it. Reuse is what turns a single breach into several compromised accounts.