Create a strong, random password with the length and character types you choose. Everything happens in your browser, and nothing is sent anywhere.
Generated using your browser's cryptographically secure random number generator. Nothing is sent anywhere. Your password never leaves this page.
Each password is built from the character types you select, using your browser's cryptographically secure random number generator (crypto.getRandomValues). That generator is designed to be unpredictable in a way ordinary random functions such as Math.random are not. To keep every character equally likely, the tool rejects random values that would otherwise favor some characters over others, rather than simply taking a remainder.
Every character type you turn on is guaranteed to appear at least once, and the characters are then shuffled so the guaranteed ones do not sit in predictable positions. This matters because many sites require at least one number or symbol. Without that guarantee, a plain random draw of 16 characters from all four types leaves out at least one type about 15.6% of the time, and at 12 characters about 27.5% of the time. The look-alike option removes characters that are easy to confuse when reading or typing a password, such as zero and the letter O, or the number one and a lowercase L.
Entropy measures how many guesses a brute-force attacker would need on average. It is calculated as the password length multiplied by the base-2 logarithm of the size of the character set. The estimated crack time assumes an attacker can try 10 billion guesses per second, a reasonable figure for a fast offline attack against a leaked password hash, and it divides the total number of combinations by two, since an attacker finds the password halfway through the search on average.
With the default settings, length 16 and all four character types on, the character set has 88 possible characters per position (26 uppercase, 26 lowercase, 10 numbers, and 26 symbols). That gives about 103 bits of entropy. At 10 billion guesses per second, it would take roughly 21 trillion years to crack by brute force on average, which this tool rates as "Strong."
Each extra character multiplies the number of possible passwords by the size of the character set, so length is the most powerful lever. Using all four character types (88 characters):
These figures are for a random password. A password made of a dictionary word with a number tacked on is far weaker than its length suggests, because attackers try common patterns first.
Turning off symbols does less damage than shortening the password. A 16-character password of letters and numbers only (62 characters) still has about 95 bits of entropy, or roughly 76 billion years of brute-force time. By contrast, a lowercase-only password of 8 characters has about 38 bits and falls in about 10 seconds, and a 6-digit numeric code has only about 20 bits and falls instantly. If a site rejects certain characters, uncheck those types and add a few more characters instead.
A passphrase is several random words strung together. Picking words at random from a list of 7,776 words gives about 12.9 bits per word, so 4 words is about 52 bits, 5 words about 65 bits, and 6 words about 78 bits. Passphrases are easier to type and remember, which makes them a good choice for the few passwords you must memorize, such as the master password of a password manager. For everything else, a long random password stored in a manager is the strongest and easiest option.
To count the length of a passphrase or a text, try the Word and Character Counter. You can also use the Random Number Generator for other random picks, and the Text Case Converter to switch a passphrase between lowercase, UPPERCASE and Title Case.
Does this tool store or send my password anywhere?
No. Your password is generated and displayed entirely in your browser using JavaScript. It is never sent to a server, logged, or stored anywhere. Closing or refreshing the page discards it completely.
How random is the password, really?
It uses crypto.getRandomValues, the Web Crypto API's cryptographically secure random number generator, rather than Math.random. This is the same category of randomness used for cryptographic keys, and is suitable for generating passwords.
What length should I use?
Longer is stronger. 12 characters is a reasonable minimum for most accounts today, 16 or more is comfortably strong, and password managers make longer passwords no harder to use since you do not need to type or remember them.
Should I turn off symbols or numbers if a site rejects them?
Yes. Uncheck whichever character types a site does not allow, then increase the length slightly to compensate for the smaller character set. A longer password from fewer character types can still be very strong.
How is the crack time estimate calculated, and how accurate is it?
It divides the total number of possible passwords by twice an assumed guessing speed of 10 billion attempts per second, which approximates the average number of guesses needed. Real attacks vary enormously based on the attacker's hardware and the hashing algorithm protecting the password, and well-designed sites make guessing far slower. Treat this as an order-of-magnitude estimate rather than an exact figure.
Is a password from this generator safe to reuse across sites?
No. Reusing any password across sites means a breach of one site can expose your account on others. Generate a new, unique password for each account, and use a password manager to keep track of them.
Why does the password look hard to remember?
Randomness is what makes it hard to guess, which also makes it hard to memorize. That trade-off is intentional. Use a password manager to store generated passwords so you do not need to remember them yourself.
Why does my password always include every type I selected?
The generator guarantees at least one character from each selected type, because many websites require them and a purely random draw can leave one out. The remaining characters are chosen freely and the whole password is shuffled. This changes the strength by only a tiny amount compared with a fully random draw, so the entropy figure remains a good estimate.