Strong Password Generator
Random passwords made on your own device with proper cryptographic randomness — length, symbols and ambiguity all yours to set.
Made on your device with cryptographic randomness — never shown to us, never stored, gone when you leave. Use a password manager to keep it.
Fast, easy and free — your answer appears as you type, and whatever you enter stays on your device.
A strong random password the moment the page opens, made on your own device with cryptographic randomness — never transmitted, never stored. Length and character sets are yours to set, with the entropy consequences shown honestly.
How to use it
- Take the one offeredA 20-character password from all four sets is already strong. Copy sits on the password itself.
- Or tune itLength up to 64; character sets on or off; look-alike characters (0/O, 1/l/I) removable for passwords someone might type from paper.
- Store it properlyStraight into a password manager. The whole point of a random password is that nobody — including you — memorises it.
What makes a password strong
Only two things: the size of the space it was drawn from, and the honesty of the draw. Length times alphabet gives the space — the entropy figure under every password here. The draw is where generators differ: patterns, keyboard walks and word-plus-number recipes collapse the space catastrophically, because attackers try likely candidates first. A uniform random draw has no likely candidates. That is the entire design of this tool: a true draw, from a space you size, with the size reported.
Details that are deliberate
Every ticked character set is guaranteed at least one representative — sites that demand "at least one symbol" are satisfied — and the guarantee is then shuffled in, so its position leaks nothing. Randomness comes from the platform's cryptographic source with rejection sampling, the technique that avoids the subtle bias of the naive modulo approach. None of it is visible in the output, which is rather the point: strength you can state, from mechanics you never need to think about.
Generated on your device, shown once, kept nowhere.
Questions people ask
How long should a password be?
For anything guarding money or email: 16 characters minimum, and longer costs you nothing when a manager does the remembering. The entropy line under the password translates settings into bits — 80 bits is strong against offline cracking, 100+ is comfortably beyond it.
Is a password from a website safe to use?
The honest general answer is 'you cannot tell' — which is why this one is generated on your device, by your browser's cryptographic source, with nothing sent anywhere. There is no server to log it. That claim is verifiable in your browser's network panel, but the deeper answer is: whatever generator you use, the password should immediately live in a manager and nowhere else.
What does the entropy figure mean?
Bits of randomness: each bit doubles the guesses an attacker needs. It is length × log2(alphabet size), so length beats character variety — adding 4 characters helps more than adding symbols. The label turns settings into a verdict so the trade-offs are visible.
Why skip look-alike characters?
0/O and 1/l/I are indistinguishable in many fonts. For a password typed from a screen or paper — wifi codes, a shared account written on a whiteboard — removing them prevents the classic transcription failure. It slightly reduces entropy; add two characters of length and you are ahead again.
Should every account get its own password?
Yes, without exception — reuse is how one breached site becomes ten. Random generation only delivers its value when each password is unique, which in practice means a manager. Tap New password once per account; they are free.
Are passphrases better?
Different trade-off: four random words are easier to type and memorise, similar entropy at greater length. For the one or two passwords a human must actually remember (the manager's master), a passphrase is the right choice. For the hundreds a manager remembers, random strings like these are denser.