Password Generator
Create a strong, random password or a memorable passphrase. Everything happens in your browser - nothing is sent, logged, or stored.
Generated locally with your browser's cryptographic random source. We never see it.
What makes a password strong
The single most important factor is length. A short password made of random symbols is still weaker than a longer one, because every extra character multiplies the number of combinations an attacker has to try. A 12-character random password is reasonable; 16 or more is comfortable; 20+ is what this tool defaults to.
The second factor is randomness. Passwords that are easy for you to invent - a pet's name, a birth year, "Summer2026!" - are also easy for cracking software to guess, because it starts with dictionary words, common substitutions, and dates. A password chosen by a computer's cryptographic random source has no such pattern. This generator uses your browser's Web Crypto API, the same randomness banks rely on, not the predictable Math.random().
The third factor is uniqueness. Even a perfect password is dangerous if you reuse it. When one site is breached, attackers try that same email-and-password pair on hundreds of other services - this is called credential stuffing, and it is how most account takeovers actually happen. A different password for every account contains the damage to one site.
Random password or passphrase?
A random password like k7$Rf2!qXb9wZ packs the most strength into the fewest characters. It is ideal when a password manager remembers it for you and you never type it by hand.
A passphrase like Copper-Harbor-Velvet-92-Rocket strings several random words together. It is far easier to type and read aloud, yet a five-word passphrase is extremely hard to crack because the attacker still has to guess which words, in which order. Passphrases shine for the handful of passwords you must remember yourself - your device login, your password manager's master password, your email.
How to store passwords safely
Once your passwords are long, random, and unique, you cannot possibly remember them all - and you should not try. Use a password manager. It generates and stores a different password for every site, fills them in automatically, and locks everything behind one strong master passphrase (a great use for the passphrase mode above). Reputable options include Bitwarden, 1Password, and KeePass.
Whatever you do, avoid the common traps: do not save passwords in a plain text file or spreadsheet, do not email them to yourself, and do not let a shared browser on a public computer remember them.
Frequently asked questions
Is this password generator safe?
Yes. Passwords are created entirely inside your browser using the Web Crypto API. Nothing is transmitted to any server, logged, or stored - you can even disconnect from the internet after the page loads and it still works. Refresh the page and the password is gone for good.
How long should my password be?
For everyday accounts, aim for 16 characters or more with a mix of character types. For anything important - email, banking, your password manager's master password - use 20+ characters or a 5-6 word passphrase.
What does the strength meter measure?
It estimates entropy in bits - roughly, how many guesses an attacker would need. Under about 50 bits is weak, 50-70 is decent, and above 80 bits is strong enough that brute-forcing is impractical with today's hardware.
Why not just use Math.random()?
The ordinary Math.random() function is predictable and not designed for security - given a few outputs, its sequence can be reconstructed. This tool uses crypto.getRandomValues(), which is cryptographically secure.
Should I reuse a strong password across sites?
No. Reuse is the biggest real-world risk. If any one site is breached, attackers try that password everywhere else. Generate a fresh one for every account and let a password manager remember them.