Result
Your password appears here
—
Generated locally — nothing is sent anywhere
16
How to use the password generator
Coming up with hard-to-guess passwords yourself is difficult, and it is tempting to reuse them. This tool uses the browser's cryptographic randomness to create a strong, random password on the spot. The result is never sent anywhere.
How to use it
Choose a length with the slider, tick the character types you want (upper case, lower case, digits, symbols) and press Generate. If you often type it by hand, enable "Exclude look-alikes" to avoid confusing 0 with O or 1 with l.
What makes a strong password
Security depends mostly on length and character variety. In general, 12 characters or more mixing several types is strong. Most important is using a different password per service so one breach does not spread. Since remembering many is hard, a password manager is recommended.
Frequently asked questions
How are passwords generated?+
Using the browser's cryptographic randomness (crypto.getRandomValues), characters are chosen at random from the selected sets.
This is secure, hard-to-predict randomness — stronger than plain Math.random.
This is secure, hard-to-predict randomness — stronger than plain Math.random.
Is the generated password sent anywhere?+
No. Generation happens entirely in your browser, and the generated password is never sent to or stored on a server.
What makes a strong password?+
Length matters most: 12 or more characters mixing upper case, lower case, digits and symbols is strong.
Not reusing passwords across services is equally important.
Not reusing passwords across services is equally important.
What does "exclude look-alike characters" mean?+
It removes easily confused characters such as 0 and O, or 1, l and I, from the candidate set.
This helps when you type the password by hand or copy it from paper.
This helps when you type the password by hand or copy it from paper.
Is it OK to reuse the same password?+
Not recommended. If one service is breached, others are at risk.
Use a different password per service and consider a password manager.
Use a different password per service and consider a password manager.
How it works
・Randomness comes from the Web Crypto API's
・Strength estimate = log2(character set size) × length (approximate entropy in bits).
・Guidance follows common recommendations such as those from OWASP (Open Worldwide Application Security Project).
・Randomness comes from the Web Crypto API's
crypto.getRandomValues (cryptographically secure). Characters are chosen avoiding modulo bias.・Strength estimate = log2(character set size) × length (approximate entropy in bits).
・Guidance follows common recommendations such as those from OWASP (Open Worldwide Application Security Project).
Please note
This site does not represent any organization and does not guarantee the security or accuracy of the results. The strength estimate is only a reference. Manage passwords for important accounts at your own responsibility, ideally alongside a trusted password manager.
This site does not represent any organization and does not guarantee the security or accuracy of the results. The strength estimate is only a reference. Manage passwords for important accounts at your own responsibility, ideally alongside a trusted password manager.