Result
How to use the password generator, and what makes a password safe
Passwords we invent ourselves tend to be memorable, which is another way of saying guessable. This tool generates unpredictable strings using the browser's cryptographic random source (crypto.getRandomValues). Nothing generated here is transmitted or stored.
How to use it
Choose a length and which character sets to include (lower case, upper case, digits, symbols). Regenerate as often as you like and copy the result straight into your password manager. When a site restricts which symbols are allowed, the practical move is to drop symbols and add characters instead.
Length beats complexity
Strength is measured in entropy: length × log2(size of the character set). Eight characters of lower case and digits (36 options) gives about 41 bits; the same alphabet at sixteen characters gives about 83. Mathematically, adding length buys more strength than adding symbols. As a target, important accounts deserve 80 bits or more — roughly 13+ characters with mixed sets.
Routine expiry is out of favour
The US NIST guideline (SP 800-63B) advises against arbitrary periodic password changes, because forced rotation pushes people towards predictable patterns like "Password1", "Password2". What it asks for instead is sufficient length, and an immediate change when a breach is known.
Reuse is the real danger
Most account takeovers are not brute force. They are credential stuffing: replaying username and password pairs leaked from one service against every other service. However strong a password is, reusing it means one breach anywhere unlocks everything. Using a different password per site matters more than any amount of extra length.
Managing them, and two-factor authentication
Remembering a long unique password per site is not realistic, so the standard advice is to store generated strings in a password manager and memorise only the master password. For that one, a passphrase of four or more unrelated words is both memorable and strong. Then enable two-factor authentication on email, banking and social accounts, so a leaked password alone is not enough to get in.
Frequently asked questions
How are passwords generated?+
This is secure, hard-to-predict randomness — stronger than plain Math.random.
Is the generated password sent anywhere?+
What makes a strong password?+
Not reusing passwords across services is equally important.
What does "exclude look-alike characters" mean?+
This helps when you type the password by hand or copy it from paper.
Is it OK to reuse the same password?+
Use a different password per service and consider a password manager.
・Randomness comes from the Web Crypto API crypto.getRandomValues (cryptographically secure). Characters are chosen avoiding modulo bias, entirely on your device.
・Estimated entropy (bits) = length × log2(character set size); about 6.5 bits per character over a 94-symbol set.
・NIST Special Publication 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management (arbitrary periodic expiry is not recommended; prioritise length and change on compromise)
・OWASP (Open Worldwide Application Security Project). Authentication Cheat Sheet (general password policy guidance)
This site does not represent any organization and does not guarantee the security or accuracy of the results. The strength estimate is only a reference. Manage passwords for important accounts at your own responsibility, ideally alongside a trusted password manager.