FREE TOOL · GENERATED ON YOUR DEVICE
Secure password generator
Length, character sets, entropy shown. The draw uses your browser's cryptographic generator — never Math.random.
Secure password generator
—
What actually makes a password strong
Length matters more than complexity. A twenty-character lowercase password resists better than an eight-character one stuffed with symbols, because the number of combinations grows exponentially with length.
The entropy figure shown on the right measures exactly that, in bits. Below 60 bits, a well-equipped attacker can break the password offline. From 80 bits upward, brute force stops being a realistic option. This tool's default setting exceeds 100 bits.
Why the randomness matters as much as the length
This tool uses crypto.getRandomValues, the browser's cryptographic generator. Many online generators use Math.random, which is not built for security and produces predictable sequences from an internal state.
Ambiguous characters — l, I, 1, O, 0 — are excluded by default, because a password you have to dictate or retype by hand eventually gets simplified by its owner. You can put them back if the password will never be read by a human.
A good password does not replace a manager
Generating a strong password achieves nothing if you reuse it across sites: a single breach then compromises every account. The rule that actually protects you is one unique password per service, which is impossible to hold in memory.
Use a password manager, and turn on two-factor authentication everywhere it is offered. This tool feeds the manager, it does not replace it. Nothing generated here is transmitted or stored.
Common questions
Is the password sent anywhere?
No. It is generated in your browser and never transmitted. No network request is made, no local storage is written.
What length should I choose?
Twenty characters suits almost every use. Go to thirty or more for a password manager's master password, or an encryption key meant to last years.
Why do some sites reject my symbols?
Many forms restrict accepted characters, sometimes out of misplaced caution. Uncheck symbols and raise the length: you will keep equivalent entropy.
What does the entropy figure mean?
The number of bits of uncertainty for anyone trying to guess the password. Each extra bit doubles the attempts required. A hundred bits represents a number of combinations out of reach of current hardware.
Application security does not stop at passwords.
Outdated dependencies, missing headers, data exposed by an over-talkative API: these are the defects audits actually find, and none of them are fixable from the user's side.