Password Generator
A strong password is long, random and unique to one account. This generator builds passwords from 8 to 64 characters using your browser's cryptographically secure random number generator, so nothing is sent to a server. A 20-character password using letters, digits and symbols has more than 120 bits of entropy.
Entropy = length × log2(character pool). Generated with crypto.getRandomValues on your device.
How to use the Password Generator
- A new 20-character password appears as soon as the page loads.
- Drag the Length slider to set between 8 and 64 characters.
- Tick the character sets you want: A-Z, a-z, 0-9 and symbols. Keep No look-alikes on to avoid I, l, 1, O, 0 and o.
- Press Generate for a new password, then Copy to put it on your clipboard.
Formula
entropy (bits) = length × log2(pool size)Each character is drawn with crypto.getRandomValues using rejection sampling, so every character in the pool is equally likely. At least one character from each selected set is included and the result is shuffled. Under 50 bits is rated weak, 50 to 79 fair, 80 to 119 strong and 120 or more very strong.
What makes a password strong
- Length matters most: each extra character multiplies the number of possible passwords
- Randomness: generated passwords avoid the patterns people fall into
- Uniqueness: a different password for every account stops one breach from unlocking the rest
- A password manager lets you use long random passwords without remembering them
Privacy
Passwords are generated in your browser with the Web Crypto API. They are not sent to or stored on any server.
Password Generator questions
What makes a password strong?
Length, randomness and uniqueness. Use at least 12 to 16 random characters, mix letters, digits and symbols, and never reuse a password across accounts. Avoid dictionary words, names and dates. A password manager makes it practical to keep a different strong password for every site.
How long should my password be?
Use at least 12 characters for everyday accounts and 16 or more for email, banking and anything that can reset other accounts. Length adds more security than complexity: a 20-character random password is far harder to crack than a 10-character one with symbols.
Are the generated passwords truly random?
Yes. They come from crypto.getRandomValues, the browser's cryptographically secure random number generator, with rejection sampling so every character is equally likely. Ordinary Math.random is not used. The password never leaves your device. That means no pattern links one password to the next, and no copy is stored anywhere. Each new press of Generate draws fresh random values, so you can create as many passwords as you need.
How often should I change my passwords?
Change a password immediately if a service reports a breach or you suspect someone else knows it. Current NIST guidance does not recommend forced periodic changes for strong, unique passwords, because frequent changes push people toward weaker patterns. Updating breached or reused passwords matters far more than changing strong ones on a schedule.
Should I use a password manager?
Yes. A password manager stores long random passwords for every account behind one strong master password, fills them in for you and warns about reused or breached passwords. Reputable options include Bitwarden, 1Password and the managers built into modern browsers and phones.
What is two-factor authentication and should I enable it?
Two-factor authentication adds a second check, such as an authenticator app code or a hardware key, on top of your password. Even if a password leaks, an attacker cannot sign in without the second factor. Turn it on for email, banking and social accounts, preferring an app or key over SMS.
How do I create a password I can remember?
Use a passphrase of four or more random, unrelated words, optionally with digits or symbols between them. Choose the words randomly rather than from a favorite quote. For everything you do not need to type from memory, let a password manager store a generated password.
What should I do if my password is compromised?
Change it right away on the affected site and on any site where you reused it. Turn on two-factor authentication, review recent account activity and sign out other sessions. Services like Have I Been Pwned can tell you whether your email address appears in known breaches.