Password Generator

Pick a length and character sets to generate a strong, random password.

StrengthVery strong95 bits
Estimated crack time: effectively uncrackable

At least one character from each selected set is included when the length allows.

Why length beats complexity

If you only change one thing about your passwords, make them longer. Every extra character multiplies the number of combinations an attacker has to try, so a long password grows out of reach far faster than a short one stuffed with weird symbols. A 16-character random password is in a different league from an 8-character one, even if the short one looks "harder." That is why this generator goes up to 64 characters: drag the slider as high as the site will accept and let the length do the heavy lifting. Complexity (mixing letters, numbers, and symbols) still helps, but it is the tiebreaker, not the main event.

Entropy and strength, without the math headache

The "bits" number under your password is entropy — basically a score for how unpredictable it is. It comes from the length and how many character types are in the pool (length times log2 of the pool size). Each extra bit roughly doubles the guessing effort, so bigger is better. We label it loosely: under about 40 bits is weak, 60-plus is solid, and 80-plus is very strong. Treat those thresholds as friendly guideposts, not guarantees — the real safety of a password also depends on who is attacking and how. The point is simple: watch the meter climb as you add length and character types.

Passwords vs passphrases — pick the right tool

A jumble like xK9#mQ2$vR is great when a computer remembers it for you. But if you have to type or memorize something yourself, a passphrase (several random words strung together) is usually friendlier and can be just as strong — that is what the Passphrase tab is for. Rule of thumb: use a random password for anything your password manager handles, and a passphrase for the handful you actually need to type, like your manager's master password or a device login.

The biggest mistake: reusing passwords

Reusing the same password across sites is riskier than having a slightly weaker one. When any single site gets breached, attackers take those leaked email-and-password pairs and try them everywhere else — it is called credential stuffing, and it is automated and cheap. One leak then becomes a skeleton key to your email, shopping, and banking. The fix is boring but effective: a unique password for every account. Generating a fresh one here each time you sign up is an easy way to keep them all different.

Let a password manager remember them

Nobody can memorize dozens of unique 16-character passwords, and you should not try. A password manager stores them in an encrypted vault and fills them in for you, so you only have to remember one strong master password (a passphrase works nicely for that). Most browsers now include a basic one for free, and dedicated apps add extras like breach alerts and cross-device sync. Generate a strong password here, paste it into the manager when you create or update an account, and let the app handle the rest.

Everything runs in your browser

This page has no backend. The password is built right on your device using the browser's built-in cryptographic randomness, and it is never sent anywhere or saved to a server — only your settings (length and which character sets to use) are remembered locally so the tool opens the way you left it. Once the page has loaded you can even disconnect from the internet and it will keep working. If you are extra cautious, that offline check is a nice way to confirm nothing is being transmitted.

Myths worth dropping

Two old habits do more harm than good. First, forcing a password change every 30 or 90 days: guidance from security bodies like NIST now recommends against routine expiry, because it nudges people toward predictable tweaks (Spring2024 then Summer2024) and adds no real protection unless a password is actually exposed. Change a password when there is a reason to — a breach, a shared device, a hint someone knows it. Second, "clever" substitutions like swapping a for @ or o for 0 in a normal word (P@ssw0rd): attackers know every one of those tricks, so they barely slow anyone down. Random length wins over cute substitutions every time.

Frequently asked questions

How long should my password be?
Longer is better — aim for at least 12 characters, and 16 or more for important accounts like email and banking. Since a password manager does the remembering, there is little reason not to push the length higher. The strength meter updates as you slide, so you can watch it move into the strong range.
Are these passwords generated securely?
Yes. Randomness comes from crypto.getRandomValues, the browser's cryptographically secure source, and the integer sampling uses rejection sampling so every character is equally likely (no modulo bias). Math.random is never used. At least one character from each set you tick is guaranteed.
Are my generated passwords saved or sent anywhere?
No. The password is created on your device and is never transmitted or stored on any server — there is no server. Only your settings, like the length and which character sets are on, are saved in your browser's local storage so the tool remembers your preferences.
Should I change my passwords every few months?
Not just because time has passed. Modern guidance (including from NIST) advises against routine forced rotation, since it tends to produce predictable variations. Change a password when there is a real trigger: a known breach, a device you no longer trust, or any sign it may have leaked.
What does the estimated crack time mean?
It is an illustrative figure based on a fast offline brute-force attempt, not a promise. Real crack time swings enormously with the attacker's hardware, the method, and how the target site stores passwords. Use it to compare your options here, not as a guarantee of safety.
Do I really need a different password for every site?
Yes, and it is the single most valuable habit. Reusing one password means a breach at any site can unlock the others through automated credential-stuffing attacks. Generate a unique one here for each account and store them in a password manager so you never have to memorize them.