Password generator

Create a strong, random password that never leaves your browser.

Did you know?

A strong password is at least 16 characters and mixes uppercase, lowercase, numbers and symbols. This tool builds one using your browser’s secure random generator — nothing is sent to a server.

Read the full guide →
·········
Copied to clipboard

What makes a strong password

This generator runs entirely in your browser using the cryptographically secure random generator built into your device. Your password is never sent over the internet or stored anywhere.

How to use it

Set the length, choose which character types to include, and a new password is generated instantly. Click Regenerate for another, then Copy.

Why length matters more than complexity rules

A 20-character password using only lowercase letters is harder to crack by brute force than a 10-character password with every character type mixed in. Each additional character multiplies the number of possible combinations, while adding character types only multiplies it by a small, fixed factor. If a site limits length but not complexity, length is still the setting worth maximizing first.

What to avoid

Skip anything based on personal information — birthdays, pet names, addresses — even with numbers substituted for letters, since those substitutions are the first thing cracking tools try. Reusing a password across accounts means one breach exposes every account that shares it, regardless of how strong the password itself is.

How a breach on one site turns into many

The mechanism is called credential stuffing: if a password gets exposed in a breach on a low-security site and you've reused it elsewhere, attackers don't need to crack anything — they just try that same email-and-password pair automatically against banks, email providers and other major services. A single reused password is only as safe as the weakest site you've ever used it on, which is the real argument for a unique, generated password per account rather than a strong-but-memorable one repeated everywhere.

Passphrases vs. generated passwords

A passphrase — several random, unrelated words strung together — can be just as strong as a generated password, since length is what drives the real security either way. The catch is the word "random": a phrase built from a famous quote, a song lyric, or a common saying is not actually random, and is exactly the kind of pattern cracking tools are built to try first. Where a passphrase can matter is memorability — for the handful of passwords you genuinely need to type from memory (a device passcode, a password manager's own master password), a long, truly random passphrase is easier to recall than a random string of symbols. For everything else, a fully random generated password like the one above is simpler, since a password manager remembers it for you either way — you only need to actually recall the small handful of passwords that unlock the manager itself.

What government guidance says

The length-first, unique-password approach isn't just industry folklore — CISA (the U.S. Cybersecurity and Infrastructure Security Agency) recommends the same fundamentals: long, randomly generated passwords, a unique one per account, and a password manager to store them. If a passphrase is more your style, CISA's own guidance suggests stringing together 5-7 unrelated words rather than a memorable phrase or quote — the "unrelated" part is what keeps it resistant to guessing.

FAQ

How long should a password be?

Aim for at least 16 characters. Each extra character makes a password exponentially harder to crack.

Is this password generator safe?

Yes. It runs entirely in your browser using a cryptographically secure random generator. Nothing is sent to a server or saved.

Should I use a different password for each account?

Yes. Reusing passwords means one breach can compromise many accounts. Generate a unique password per site and store them in a password manager.

How does reusing a password actually lead to other accounts being hacked?

Through credential stuffing: attackers take an email-and-password pair leaked from one breach and automatically try it on other major sites. No cracking is needed — if you reused that password, it just works.