Password Generator
Free secure password generator.
Generate strong, random passwords in your browser. Choose the length and which character types to include — uppercase, lowercase, numbers, symbols — and optionally exclude look-alike characters that are easy to misread. A strength indicator shows how robust each password is, and one click copies it.
Every password is created locally using your browser's cryptographic random number generator and is never transmitted or stored anywhere.
What makes a password strong
Two things determine a password's resistance to guessing: length and unpredictability. Length matters most — each extra character multiplies the number of possibilities an attacker must try, so a long password from a smaller character set often beats a short one packed with symbols. Unpredictability means the characters must be genuinely random, not a word with a few letters swapped for numbers, which cracking tools expect. This generator maximises both: it draws every character from your chosen sets using cryptographic randomness, so there's no pattern to exploit.
Use a manager, and never reuse
A strong password only helps if you don't reuse it. The most common way accounts get compromised isn't cracking — it's a leak from one site being tried on all your others. The practical answer is a password manager: let it generate and remember a unique long password for every account, so you only memorise one master passphrase. Generate a fresh password here for each new sign-up and store it in your manager. Because generation happens entirely on your device, you can trust that the password you copy has never left your browser or been logged anywhere.
Passphrases: another strong option
Random character strings are the strongest passwords for fields you never type by hand, but they're miserable to memorise. For the few passwords you do need to remember — your device login, your password manager's master key — a passphrase of several random unrelated words can be both strong and memorable, because length drives strength and a handful of random words is very long. The password this tool generates is ideal for the hundreds of accounts a manager stores for you; reserve a memorable passphrase for the one or two keys that unlock everything else. Either way, uniqueness per account is the rule that matters most.
Frequently asked questions
Are these passwords really random?
Yes. They use the browser's crypto.getRandomValues, a cryptographically secure random source — not the predictable Math.random.
Is my password sent anywhere?
No. Generation is entirely local to your browser. Nothing is uploaded, logged, or stored.
How long should my password be?
For important accounts, 16 characters or more is a sensible minimum. Longer is stronger; pair it with a password manager so length isn't a memorisation burden.
Why exclude look-alike characters?
Characters like l, 1, I, O and 0 are easy to confuse when typing a password by hand. Excluding them helps if you'll ever read or transcribe it manually.
How often should I change my passwords?
Current guidance favours long, unique passwords you change only when there's a reason — a breach or suspected compromise — rather than on a forced schedule, which tends to produce weaker, patterned passwords.
Last updated: 2026-01-20