What is the Password Generator?
A strong password is long and random. This generator uses your browser’s cryptographically secure random number generator, the same source used for encryption keys, with no bias towards any character, so every password is truly unpredictable.
Choose a random password for accounts you store in a password manager, or a passphrase of random words that is easier to remember and type, for example on a phone or a TV. The strength meter shows how long it would take a well-funded attacker to guess.
How to use it
- Choose Password or Passphrase.
- Set the length (or number of words) and the kinds of characters to use.
- Click Generate for a new one, or generate several at once.
- Copy it into your password manager.
Example
16 characters, all character types
q7#Rv!2mXe$Lp9Wz
Features
- Secure randomness. Uses crypto.getRandomValues with rejection sampling, so there is no modulo bias.
- Every character type. Each selected type (lowercase, uppercase, digits, symbols) is guaranteed to appear.
- No look-alikes. Optionally leave out characters like I, l, 1, O and 0 that are easy to confuse.
- Passphrases. Random words from the 2,048-word BIP39 list, with separators, capitals and a number.
- Strength meter. Entropy in bits and an estimate of the time to crack.
- Never sent anywhere. Passwords are created in your browser and not stored or uploaded.
Frequently asked questions
How long should my password be?
At least 12 characters for everyday accounts and 16 or more for email, banking and password-manager master passwords. Length matters more than complexity: each extra character multiplies the work for an attacker.
Password or passphrase?
Use random passwords for accounts saved in a password manager. Use a passphrase of 6 or more random words for the few you must remember or type by hand, such as your password manager or device login.
Is it safe to generate passwords on a website?
This page creates passwords entirely in your browser with no network requests, and does not store them. For extra assurance you can load the page and then go offline before generating.
What does the time to crack mean?
It estimates how long an attacker guessing a trillion passwords per second would need, on average, to find this one. It assumes they know how it was generated, so it is a fair, worst-case estimate.
Should I reuse a strong password?
No. If one site is breached, attackers try the same password everywhere. Use a different password for every account and keep them in a password manager.
Last updated · Free, no sign-up, runs in your browser.