Strong password generator online
Generate genuinely random passwords with your browser's cryptographic generator, and see how long each would take to crack.
Generated locally with crypto.getRandomValues. No password is ever transmitted, logged or stored.
How to use the password generator
- Set the length. Sixteen characters is a sensible floor for anything that matters, and twenty or more for email and banking, since those accounts can be used to reset everything else.
- Choose your character sets. Leave all four on unless a site refuses symbols — some older banking portals still do, in which case add length to compensate.
- Tick the look-alikes option if you will ever type the password by hand or read it aloud. It removes the characters people confuse: lowercase L, the digit one, capital i, capital O and zero.
- Press Copy and paste it straight into your password manager. Generate ten at once if you are setting up several accounts in one session.
What you can use it for
Creating a password you have no intention of memorising is the point. Every account should have a different one, which is only workable with a password manager doing the remembering. Once the manager holds it, there is no reason for the password to be anything less than long and completely random.
Replacing a password after a breach notification is urgent work. If a service you use has been breached, that password and every variation of it should be considered public — attackers routinely try leaked credentials across other sites, which is why reuse is so damaging.
Wifi passphrases benefit from length more than complexity. A long random string is set once on each device and then forgotten, and it makes offline cracking of a captured handshake infeasible in a way that a memorable phrase does not.
Anyone setting up accounts for other people — a small business owner creating logins for staff, a developer generating initial credentials — needs several strong passwords at once. The batch button produces ten that can be distributed and then changed by each user.
Things to know about password strength
This uses crypto.getRandomValues, the browser's cryptographically secure random number generator, not Math.random. That distinction matters: Math.random is predictable enough that its output should never be used for anything security related, and a surprising number of online generators still use it.
Length beats complexity. A twenty-character lowercase password has considerably more entropy than an eight-character one using every symbol on the keyboard. The old advice about mixing character types came from an era of eight-character limits, and it produced passwords that were hard for humans and easy for machines.
The old rules actively backfired. Requiring an uppercase letter, a digit and a symbol led everyone to the same pattern — Password1! — which attackers model directly. NIST's current guidance dropped composition rules entirely and recommends length plus a check against known breached passwords instead.
Crack time estimates assume offline attacks against a stolen password hash, at a rate of about a hundred billion guesses per second. They are a rough guide to relative strength, not a promise. A password is only as safe as the weakest place you store it, which is why reuse and unencrypted notes matter more than the last two characters of entropy.
Frequently asked questions
Sixteen characters minimum for ordinary accounts, twenty or more for email, banking and your password manager's master password. Since a manager types it for you, there is no cost to extra length. Anything under twelve is genuinely weak against a determined offline attack.
The generation itself is: it uses your browser's cryptographic random source, runs entirely on your device, and transmits nothing. You can verify that by disconnecting from the internet — it keeps working. The residual risk is your own device, so do not use it on a shared or public computer.
No, not on a schedule. Forced rotation makes people pick weaker, more predictable passwords and write them down. Current guidance from NIST and the UK NCSC is to use long unique passwords and change them only when there is a reason to — a breach notice, a shared password, or a suspicion of compromise.
Several genuinely random words are a good option when you must memorise something, such as your password manager's master password. For the hundreds of passwords you never type yourself, a random string is stronger per character and there is no benefit to making it pronounceable.
In a dedicated password manager. Browser-stored passwords are better than reuse but weaker than a proper manager. A text file, a notes app, or a spreadsheet are all effectively unprotected, and email drafts are worse still.