Where a generated password should come from
A password is only as unpredictable as the randomness behind it. Generators that use ordinary random functions, or that build a password on a server, give you something that looks random but was produced somewhere you cannot inspect and sent over a network you do not control.
Everything here is generated with your browser's cryptographic random source, the same one used for encryption keys, and never leaves the page. You can load the page, disconnect from the internet and keep generating, which is the simplest possible proof that nothing is being transmitted.
Five ways to generate
The character generator builds classic passwords from uppercase, lowercase, digits and symbols, with options to exclude look-alike characters such as l, 1, I and O when a password will be read aloud or typed from paper. The passphrase generator strings together words from a curated list, which produces something long, strong and actually memorable.
The PIN generator handles numeric codes, the bulk generator produces a list at once for onboarding a team or seeding test accounts, and the strength analyzer scores any password you paste in, showing its entropy and what makes it weak.
- Characters, with full control of the character set.
- Passphrases built from real words.
- Numeric PINs.
- Bulk lists and a strength analyzer.
Length beats complexity
Every extra character multiplies the number of possibilities, while swapping an a for an @ adds almost nothing, because attackers try those substitutions first. A 16 character password from a full character set is far beyond brute force with current hardware, and a four or five word passphrase is comparable while being much easier to type.
The number that matters is entropy, measured in bits. Roughly speaking, 60 bits is fine for an ordinary account, 80 bits is strong, and above 100 bits the password is not the weak point of your security any more.
What to do with the password afterwards
Use a different password everywhere, and keep them in a password manager rather than a note or a spreadsheet. Reuse is what turns one company's breach into a problem for all your accounts, and a manager makes unique passwords practical.
Turn on two-factor authentication wherever it is offered, especially for email, because whoever controls your inbox can reset most of your other accounts.
Password generator questions
Are the passwords sent anywhere?
No. They are generated in your browser and never transmitted. You can disconnect from the internet and keep using the page.
How random are they?
They use your browser's cryptographic random source, the same one used for encryption keys, not an ordinary random function.
How long should a password be?
At least 16 characters, or four to five words as a passphrase. Length matters more than symbol substitutions.
Are passphrases as strong as random characters?
Yes, when they are long enough and the words are chosen randomly, which is what the generator does.
Does it keep a history?
Recent results can be kept in your browser's local storage on your device only, and you can clear them at any time.
Can I generate many passwords at once?
Yes. The bulk generator produces a list you can copy or save.