Password Generator
Generate a random password using your browser's cryptographically secure random number generator. Nothing is sent anywhere — the password only ever exists on your screen.
Strength: Very strong
How randomness works here
This tool uses crypto.getRandomValues(), the Web Crypto API's cryptographically secure random number source — the same underlying randomness used for encryption keys — rather than Math.random(), which is not designed to be unpredictable enough for security purposes.
Why length matters more than complexity
Adding characters to a password increases its strength exponentially, while adding more character types (numbers, symbols) helps but has a smaller effect. A longer password using just letters and numbers is often stronger than a short one packed with symbols.
How the strength label is worked out
The estimate is length × log2(pool size), where the pool is every character the enabled options can produce: 26 lowercase, 26 uppercase, 10 digits and 25 symbols. All four give a pool of 87, so a 16-character password scores 16 × 6.44 ≈ 103 bits, which is labelled Very strong. Twelve characters from letters and digits only (pool 62) scores 71.5 bits (Strong), while 8 characters from all four sets scores 51.5 (Fair). The labels change at 40, 70 and 100 bits.
Each extra bit doubles the number of guesses an attacker needs. At 71 bits, trying every combination at ten billion guesses per second would take about 7,500 years, with success on average halfway through. Real attack speed depends on how the website stores passwords, which is why long, random and unique matters more than any single label.
Limits and practical notes
- The score assumes the characters really are random. It says nothing about a password you chose yourself or a phrase you adapted.
- Length can be set from 8 to 64. At least one character of each ticked type is guaranteed to appear.
- Some sites reject certain symbols or cap the length. If that happens, untick symbols and add length instead, which keeps the strength high.
- Strength does not protect against phishing or a breach at the site itself. Use a unique password everywhere and turn on two-step verification where it is offered.
- Current NIST guidance favours length, expects sites to accept long passwords, and discourages forced periodic changes. Change a password when you suspect a problem, not on a schedule.
Frequently asked questions
Is it safe to generate passwords online?
This generator runs entirely in your browser using the Web Crypto API — the password is never transmitted anywhere or logged. That said, for maximum peace of mind with highly sensitive accounts, a dedicated offline password manager is a reasonable extra precaution.
Should I reuse a generated password across sites?
No — use a unique password for every account. A password manager makes this practical by remembering them for you, so you only need to recall one master password.
How long should my password be?
For a randomly generated password, 16 characters or more is a good default for important accounts. Use the maximum your password manager and the site allow for anything that protects money, email or your identity.
Does a Very strong rating mean my account can't be hacked?
No. The rating only measures how hard the password is to guess. Accounts are more often compromised by phishing, malware, reused passwords or a breach at the service, so use a unique password and two-step verification as well.