Password Generator
Strong, random passwords on your device.
Runs entirely in your browser — nothing you enter is uploaded or sent to a server.
Generated only in your browser — we never see, store or send it, which also means we can't recover it for you. Use a different password on every site and keep them in a password manager, not a note or a spreadsheet. Read our full disclaimer.
About this tool
A strong password is long and unpredictable — and modern guidance (NIST, 2026) is clear that length matters far more than a clever mix of symbols. This generator uses your browser's cryptographically secure random number generator to build passwords from the character sets you choose — lowercase, uppercase, digits, and symbols — guarantees at least one character from each set you enable, and shows a live strength estimate in bits of entropy. Nothing is ever sent anywhere: the password is created on your device, and we couldn't see it even if we wanted to.
Tip
Current guidance sets a 15-character minimum; 16–20 characters with all four sets is very strong (~100+ bits of entropy). Use a unique one per site, kept in a password manager.
How to use
- 1Set the length with the slider.
- 2Toggle the character sets you want to include.
- 3Press Generate new for a fresh password, and copy it in one click.
Features
- Cryptographically secure (Web Crypto), not Math.random.
- Pick the length and which character sets to include.
- Guarantees at least one character from every set you enable.
- Live strength estimate in bits of entropy.
Frequently asked questions
How long should a password be?
Longer is stronger. Current NIST guidance sets a 15-character minimum for a password used on its own and supports up to 64; 16–20 random characters is a comfortable, very strong choice for important accounts. If the account also has two-factor authentication, a little shorter is acceptable.
Is a longer password better than a complicated one?
Yes. Under the 2026 NIST guidelines, length beats complexity — a long password or passphrase is both stronger and easier to handle than a short one crammed with symbols. Forced symbol rules and 'change it every 90 days' resets are no longer recommended.
Are these passwords safe — can you see them?
They're generated with crypto.getRandomValues, the browser's cryptographically strong random generator, entirely on your device. Nothing is logged, stored, or transmitted, so no one (including us) ever sees the password.
What is entropy, and how strong is strong enough?
Entropy, in bits, measures how hard a password is to guess — each extra bit doubles the number of guesses needed. Roughly 70+ bits is strong and 100+ is very strong; 16 characters across all four sets lands around 100 bits.
Should I reuse a generated password?
No — use a unique password for every account, so one site's breach can't unlock the others. A password manager is the practical way to generate, store, and autofill them; keep them there, not in a note or spreadsheet.
Are passphrases a good alternative?
Yes — a passphrase of several random words is long, memorable, and strong, and modern guidance explicitly supports it. This tool makes random-character passwords (ideal for a manager); if you need something you'll type by hand, a multi-word passphrase is a solid option.
More developer tools
View allRandom String Generator
Generate random strings at any length from the character sets you choose — lowercase, uppercase, numbers, symbols — copy them one at a time or all at once.
Open toolHash Generator
Compute cryptographic hash digests of any text with SHA-1, SHA-256, SHA-384, and SHA-512 — locally, using your browser's built-in Web Crypto API.
Open toolJWT Decoder
Decode a JSON Web Token to read its header and payload claims in a readable format — locally in your browser, with no signature verification.
Open tool