Password Generator
Create strong, random passwords with custom length and character rules.
Select at least one character set
Passwords are generated locally in your browser using the Web Crypto API. Nothing is sent to a server or stored anywhere.
Generate strong, random passwords with a custom length and choice of character sets — uppercase, lowercase, numbers, and symbols — so you get a password that's actually hard to guess or brute-force, rather than a predictable pattern.
Every password is generated locally in your browser using your device's random number generator; nothing is transmitted or stored anywhere.
How length beats complexity
| Password | Character set | Combinations |
|---|---|---|
| 8 characters | Lowercase only | ~2×10¹¹ |
| 8 characters | All types | ~6×10¹⁵ |
| 12 characters | All types | ~7×10²³ |
| 16 characters | All types | ~9×10³¹ |
| 4 random words | Diceware wordlist | ~1×10¹⁵ |
Adding characters multiplies the search space far faster than adding character types. A 16-character lowercase password beats a 10-character one using every symbol.
What actually breaks passwords
Brute force is rarely how accounts fall. The two dominant causes are credential stuffing — an attacker takes username and password pairs from one breach and tries them everywhere else — and phishing, where the strength of the password is entirely irrelevant because you handed it over.
That reorders the priorities. Uniqueness matters more than complexity, because it contains the blast radius of any single breach. Multi-factor authentication matters more than either, because it defeats a stolen password outright.
- Use a different password for every account, without exception. This is the single highest-impact habit.
- Use a password manager — it is the only practical way to keep dozens of unique passwords.
- Turn on multi-factor authentication wherever it's offered, preferring an app or hardware key over SMS.
- Stop rotating passwords on a schedule. Current NIST guidance advises against it, because forced rotation pushes people toward predictable variations.
- Protect the email account above all others — whoever controls it can reset everything else.
Passphrases, and where they fit
Four or five genuinely random words — 'correct horse battery staple' style — give strong entropy while staying memorable and typable. They're the right choice for the handful of passwords you must type by hand: your device login and your password manager's master password.
The word 'random' is doing the work there. Words you chose yourself, song lyrics, or a familiar phrase carry a fraction of the entropy, because attackers use those wordlists too. Everything else should be long random strings you never need to remember, which is what this generator produces.
Frequently asked questions
- How long should a password be?
- Most security guidance now recommends at least 12–16 characters, longer where the account supports it — length matters more for resistance to brute-force attacks than complexity alone.
- Are these passwords stored or logged anywhere?
- No — generation happens entirely in your browser using client-side randomness, and nothing is sent to a server or saved.
- Should I use the same generated password across multiple sites?
- No — use a unique password for every account, ideally kept in a password manager, so a breach on one site can't be used to access others.
- Is a passphrase better than a random string?
- For passwords you have to type from memory — your device login, your password manager's master password — yes. For everything else, a long random string stored in a manager is stronger and you never need to recall it.
- How often should I change my passwords?
- Only when there's a reason: a breach, a shared device, or a suspicion of compromise. Current NIST guidance advises against scheduled rotation, because it pushes people toward predictable variations.
- Is the randomness here cryptographically secure?
- Yes — it uses the browser's crypto.getRandomValues, the same source used for cryptographic operations, rather than Math.random.