Strong Password Generator
Random passwords made on your own device with proper cryptographic randomness, length, symbols and ambiguity all yours to set.
Drawn fresh from cryptographic randomness every time you tap New password. Use a password manager to keep it.
Free forever, no sign-up and no limits, and this tool installs on its own so you can keep it on your home screen.
A strong random password the moment the page opens, drawn from the platform's cryptographic random source rather than a predictable formula. Length and character sets are yours to set, with the entropy consequences shown honestly.
How to use it
- Take the one offeredA 20-character password from all four sets is already strong. Copy sits on the password itself.
- Or tune itLength up to 64; character sets on or off; look-alike characters (0/O, 1/l/I) removable for passwords someone might type from paper.
- Store it properlyStraight into a password manager. The whole point of a random password is that nobody (including you) memorises it.
What makes a password strong
Only two things: the size of the space it was drawn from, and the honesty of the draw. Length times alphabet gives the space, the entropy figure under every password here. The draw is where generators differ: patterns, keyboard walks and word-plus-number recipes collapse the space catastrophically, because attackers try likely candidates first. A uniform random draw has no likely candidates. That is the entire design of this tool: a true draw, from a space you size, with the size reported.
Details that are deliberate
Every ticked character set is guaranteed at least one representative, sites that demand "at least one symbol" are satisfied, and the guarantee is then shuffled in, so its position leaks nothing. Randomness comes from the platform's cryptographic source with rejection sampling, the technique that avoids the subtle bias of the naive modulo approach. None of it is visible in the output, which is rather the point: strength you can state, from mechanics you never need to think about.
Questions people ask
How long should a password be?
For anything guarding money or email: 16 characters minimum, and longer costs you nothing when a manager does the remembering. The entropy line under the password translates settings into bits: 80 bits is strong against offline cracking, 100+ is comfortably beyond it.
Is a password from a website safe to use?
The honest general answer is 'you cannot tell', so judge a generator by what it will say about itself. This one draws from the platform's cryptographic random source with rejection sampling, and prints the entropy that follows from your settings rather than a vague strength badge. The deeper answer holds whatever generator you use: the password should immediately live in a manager and nowhere else.
What does the entropy figure mean?
Bits of randomness: each bit doubles the guesses an attacker needs. It is length × log2(alphabet size), so length beats character variety, adding 4 characters helps more than adding symbols. The label turns settings into a verdict so the trade-offs are visible.
Why skip look-alike characters?
0/O and 1/l/I are indistinguishable in many fonts. For a password typed from a screen or paper (wifi codes, a shared account written on a whiteboard) removing them prevents the classic transcription failure. It slightly reduces entropy; add two characters of length and you are ahead again.
Should every account get its own password?
Yes, without exception, reuse is how one breached site becomes ten. Random generation only delivers its value when each password is unique, which in practice means a manager. Tap New password once per account; they are free.
What does the crack-time line assume?
One fixed, stated scenario: an attacker who has stolen the password database and guesses offline at 10 billion guesses per second, decent dedicated hardware against a fast hash. The figure is the time to try every combination, computed purely from the entropy bits; on average a password falls in half that. Online guessing against a live site is millions of times slower because services rate-limit attempts, so the line is the pessimistic case, not the likely one.
Are passphrases better?
Different trade-off: four random words are easier to type and memorise, similar entropy at greater length. For the one or two passwords a human must actually remember (the manager's master), a passphrase is the right choice. For the hundreds a manager remembers, random strings like these are denser.