Strong password generator
Random passwords made on your device with the browser's cryptographic random number generator. Pick a length, copy one into your password manager, done.
crypto.getRandomValues. Never sent, never stored.How the generator works
For every character, the page asks crypto.getRandomValues for a 32-bit random number and maps it onto your alphabet. Numbers that would make some characters slightly more likely than others are thrown away and redrawn (rejection sampling), so each character is exactly equally likely.
That makes the strength easy to state precisely: entropy is length × log2(alphabet size). With all 94 printable symbols, each character adds about 6.55 bits, so 16 characters give roughly 105 bits and 20 give 131. The entropy calculator explains why that formula only holds for machine-made passwords.
Store these in a password manager. The point of a random password is that you never have to remember it, and a manager fills it only on the real site, which also defeats phishing pages.
Need something you can type from memory, like a computer login or the manager's own master password? Use the passphrase generator. For a phone or card, use the PIN generator.
Generator FAQ
Is this password generator truly random?
It uses crypto.getRandomValues, the browser’s cryptographically secure random number generator, with rejection sampling so every character in the chosen set is equally likely. It never uses Math.random, which is not designed for security.
Are generated passwords sent or saved anywhere?
No. Passwords are created in your browser and exist only on this page. We don’t transmit, log or store them. Copy one into your password manager and it’s gone from here when you leave.
How long should a random password be?
For accounts stored in a password manager, 16 or more characters from the full set gives over 100 bits of entropy, far beyond any practical attack. If you must type it often, a passphrase from our passphrase generator is easier.
Should I require at least one of each character type?
Composition rules are optional here and off by default in the strength sense: NIST SP 800-63B advises against forcing them on users. We offer “at least one from each selected set” only because some sites still demand it; it costs a tiny amount of entropy.
What does “avoid look-alike characters” do?
It removes characters that are easy to confuse when reading or typing by hand: 0 O o, 1 l I | and similar. Useful for Wi-Fi keys and anything you’ll read off paper.