Secure Password Generator
Create strong random passwords in an instant, generated in your browser with its cryptographic random generator, so nothing is ever sent to our servers
Password Rules
crypto.getRandomValues, your browser’s cryptographically secure random generator.
Why real randomness protects your accounts
Many everyday random functions are predictable enough for an attacker to exploit. This tool draws from your browser’s cryptographically secure random number generator (Web Crypto API) instead.
Mixing character sets (uppercase, lowercase, digits and symbols) with enough length (16+ characters) makes the number of possible combinations grow so fast that guessing by brute force becomes impractical.
Generated Password
How to use this tool
- Set the password length with the slider or the number box.
- Tick the character sets you want: uppercase, lowercase, numbers and symbols.
- Press “New password” for a new draw and watch the strength label.
- Copy the password and save it in a password manager before closing the tab.
Worked example
A site allows only letters and digits, so you untick symbols and the pool is 26 + 26 + 10 = 62 characters. At 12 characters the entropy is 12 × log₂(62) ≈ 71.5 bits, rated Strong. If the site accepts symbols, the pool grows to 91 and the same 12 characters give about 78.1 bits; raising the length to 16 reaches roughly 104.1 bits, Very Strong. Each extra character adds more than each extra character set, so when a site allows it, length is the cheapest upgrade. Never reuse the result on a second account: entropy only counts if the password is unique and secret.
Methodology
This tool generates passwords by calling the native Web Cryptography API method window.crypto.getRandomValues(). Unlike the standard Math.random(), this ensures cryptographically secure pseudo-randomness. Each character is picked independently from the pool you tick: 26 uppercase letters, 26 lowercase letters, 10 digits and 29 symbols, up to 91 characters in total.
Five ways a random password still ends up weak
A random generator only helps if the rest of the habit is sound. These are the slips we see most often, and what the tool's numbers say about each.
- Trusting symbols over length. Eight characters from all four sets (91 characters) give about 52.1 bits, rated Moderate. Sixteen lowercase letters alone give about 75.2 bits, rated Strong. Drag the slider before you add more character sets.
- Unticking symbols without compensating. Many sites reject some symbols. Going from 91 to 62 characters at 12 characters drops 78.1 bits to 71.5 bits. Two or three more characters wins it back.
- Relying on variety in a short password. Every type you tick appears at least once, but 6 characters still leave few combinations. Add length before you add character sets.
- Reading the meter as a guarantee. It scores how the password was drawn, not how a website stores it or whether it leaked. Reusing one password on two accounts cancels the benefit.
- Closing the tab first. Nothing is saved: the password lives only in your browser's memory. Copy it into a password manager before you leave the page.
Extra security for your accounts
A hardware security key, a paper password notebook and a screen privacy filter
Yubico YubiKey 5C NFC - Multi-Factor Authentication
A USB-C and NFC hardware security key for two-factor sign-in, according to the listing. It works with the services that support security keys.
Adams Password Journal - Pocket Sized
A pocket-sized alphabetical notebook for passwords, according to the listing. Paper is offline, but keep it somewhere safe; a password manager is the alternative.
Magnetic Privacy Screen for Macbook Air
A magnetic privacy filter for a MacBook Air screen, according to the listing, which narrows the viewing angle in public places.
As an Amazon Associate we earn from qualifying purchases at no additional cost to you.
Frequently asked questions
Why is this generator safer than thinking of one myself? ▼
People are predictable and tend to rely on recognizable patterns, words, or dates, such as a capital first letter and a digit at the end. This tool uses a cryptographic API to select characters with cryptographically secure randomness, creating a string that is mathematically resilient against dictionary and brute-force attacks.
What happens to the passwords after they are generated? ▼
They stay in your browser's active memory and disappear the moment you refresh or close the page. We have no servers logging or receiving the text you generate here. Because nothing is saved, store the password in a password manager right away.
If I tick all four options, will every password contain each character type? ▼
Yes. The generator makes sure each set you tick appears at least once, then draws the remaining characters at random from the combined pool. That is why a 4-character password with all four sets always has one of each, while longer passwords mix them freely.
How long should my password be? ▼
Length matters more than variety. Each extra character from the full 91-character pool adds about 6.5 bits, while switching on one more character set adds less than one bit per character. For accounts that matter, 16 or more characters is a sensible target; NIST's current guidance sets 15 as the minimum for single-factor passwords. A unique password per site and a second factor protect you better than any single long password reused everywhere.
Is every character equally likely? ▼
Yes. The tool uses your browser’s cryptographic random generator (crypto.getRandomValues) and discards the few random values that would favor some characters over others, so every character of the pool is equally likely. It also makes sure each type you tick (capitals, small letters, numbers, symbols) appears at least once. Avoiding look-alike characters removes 0, O, o, 1, l, I and |, which makes a password easier to read aloud or type from paper at the cost of a slightly smaller pool.