Password Generator

What makes a password strong?

Password strength is measured in entropy — how many guesses an attacker would need on average. Two things drive it: length and character variety. A 16-character password drawn from upper- and lowercase letters, digits and symbols has roughly 105 bits of entropy — far beyond what any modern cracking rig can brute-force. Length beats cleverness: a long random string always outperforms a short "complex" one like P@ssw0rd!, which cracking dictionaries try first.

How this generator works

Passwords are generated on your device using the browser's crypto.getRandomValues — the same cryptographically secure random number generator (CSPRNG) used for encryption keys — with rejection sampling to avoid modulo bias. Every generated password is guaranteed to contain at least one character from each set you select. Nothing you generate ever leaves your browser: there are no network requests, no analytics on your output, and nothing is stored.

FAQ

Is it safe to use an online password generator?

It is when the generation happens client-side, as it does here. You can verify it yourself: open your browser's network tab — generating passwords makes zero requests. For maximum caution, load the page and then go offline before generating.

Are the passwords stored anywhere?

No. Passwords exist only in your browser's memory until you leave the page. We never see, transmit or log them.

What length should I use?

16+ characters for regular accounts, 24+ for anything critical (email, banking, password manager master keys — though for master keys, consider a passphrase). If a site limits symbols, keep the length and drop the symbol set — length compensates.