Create a strong, random password with the length and character types you choose.
Generated using your browser's cryptographically secure random number generator. Nothing is sent anywhere - your password never leaves this page.
Each character is picked at random from the character types you have selected, using your browser's cryptographically secure random number generator (crypto.getRandomValues), which is designed to be unpredictable in a way ordinary random number functions are not. Entropy measures how many attempts a brute-force attacker would need on average, calculated as the password length multiplied by the base-2 logarithm of the size of the character set in use. Estimated crack time assumes an attacker can try 10 billion guesses per second, a reasonable estimate for a fast offline attack against a leaked password hash.
With the default settings - length 16, all four character types on - the character set has 88 possible characters per position, giving about 103 bits of entropy. At 10 billion guesses per second, that works out to roughly 21 trillion years to crack by brute force on average, which this tool rates as "Strong."
Does this tool store or send my password anywhere?
No. Your password is generated and displayed entirely in your browser using JavaScript - it is never sent to a server, logged, or stored anywhere. Closing or refreshing the page discards it completely.
How random is the password, really?
It uses crypto.getRandomValues, the Web Crypto API's cryptographically secure random number generator, rather than Math.random. This is the same category of randomness used for cryptographic keys, and is suitable for generating passwords.
What length should I use?
Longer is stronger. 12 characters is a reasonable minimum for most accounts today, 16 or more is comfortably strong, and password managers make longer passwords no harder to use since you do not need to type or remember them.
Should I turn off symbols or numbers if a site rejects them?
Yes - uncheck whichever character types a site does not allow, then increase the length slightly to compensate for the smaller character set. A longer password from fewer character types can still be very strong.
How is the crack time estimate calculated, and how accurate is it?
It divides the total number of possible passwords by twice an assumed guessing speed of 10 billion attempts per second, which approximates the average number of guesses needed. Real attacks vary enormously based on the attacker's hardware and the hashing algorithm protecting the password, so treat this as an order-of-magnitude estimate rather than an exact figure.
Is a password from this generator safe to reuse across sites?
No - reusing any password across sites means a breach of one site can expose your account on others. Generate a new, unique password for each account, and use a password manager to keep track of them.
Why does the password look hard to remember?
Randomness is what makes it hard to guess, which also makes it hard to memorize - that trade-off is intentional. Use a password manager to store generated passwords so you do not need to remember them yourself.