Home › Tools
Pick a length, choose character types, and generate a cryptographically strong password instantly.
Include:
Length beats cleverness. Every extra character multiplies the guesses an attacker needs — a 16-character random password is stronger than any clever 8-character arrangement.
This generator uses the browser's cryptographic random source (crypto.getRandomValues) and deliberately excludes lookalike characters — 0/O, 1/l/I — so passwords stay readable when you type them.
The entropy number shown with each password tells you its real strength: below 40 bits is weak, 60+ is strong, 90+ is very strong.
Never reuse passwords. One leaked site should not unlock your email and your bank. A password manager makes fifty unique passwords effortless.
Turn on two-factor authentication everywhere it matters — email and banking first. A strong password plus 2FA stops almost all account takeovers.
Never share passwords over chat or email; real services never ask for them.
Modern password guidance (NIST Special Publication 800-63B, the standard US agencies follow) has moved away from mandatory symbol soup toward length: a long passphrase is both stronger and easier to remember than P@ssw0rd!. The maths is unambiguous — every extra random character multiplies the search space by the size of the character set. A 16-character random password from a 95-character keyboard has over 10^31 possibilities, which is beyond any realistic brute-force campaign.
Randomness is the other half of strength. Humans are predictable: we capitalise the first letter, append 123 or our birth year, and swap a for @. Attackers know all of this and try these patterns first. A generated password has none of your fingerprints on it.
Breach studies are sobering: year after year the most common passwords in leaked databases are 123456, password, and qwerty. Worse, most people reuse the same password across sites, so one breach unlocks ten accounts. The defenses are boring but proven: a unique password per site, a password manager to hold them, and multi-factor authentication on anything that matters.
Our generator runs entirely in your browser — nothing is transmitted, logged or stored. If you want maximum safety for a critical account, generate here while offline, and never share it over chat or email; anyone legitimately needing access should have their own credentials.
You might also find these useful: