Password Generator
Create a strong, random password with rules you control — generated locally in your browser, never sent anywhere.
How randomness is generated
This tool uses the browser's crypto.getRandomValues() API — a cryptographically secure random number source — rather than Math.random(), which is not suitable for anything security-related. Nothing you generate here is sent to a server; the password exists only in your browser tab.
What actually makes a password strong
- Length matters more than complexity rules — a 16-character password from a mix of character types is far harder to guess than an 8-character one with symbols crammed in
- Avoid reusing the same password across sites; a password manager is the practical way to keep unique ones for each account
- Some older sites restrict allowed symbols — if a generated password is rejected, untick "Symbols" and regenerate
Frequently asked questions
How long should a strong password be?
At least 12–16 characters is a reasonable modern baseline; longer is generally better. Length has a bigger impact on how hard a password is to crack than complexity rules like requiring symbols.
Is this password generator actually secure?
Yes — it uses the browser's crypto.getRandomValues() API, a cryptographically secure random number source, rather than Math.random(), which is not designed for security purposes. The password is generated entirely in your browser and never transmitted anywhere.
Why was my generated password rejected by a website?
Some sites restrict which symbols are allowed, or require a specific mix (like at least one number and one uppercase letter). If a password is rejected, try unticking Symbols, or regenerate a few times until you get one that fits the site's rules.
Should I use the same strong password for multiple accounts?
No — reusing passwords means one breached site can compromise all your other accounts. Generate a unique password per site and use a password manager to keep track of them.