Password generator
Strong random passwords made on your device. Nothing is stored, logged or sent anywhere.
More at once
Check a password you already use
What makes a password strong
Attackers do not guess your password by hand; they run billions of guesses a second against stolen hashes. What defeats them is unpredictability: a long, truly random password. Patterns like Summer2026! look complex but are easy to guess, while 20 random characters are out of reach.
Use a different password per site and keep them in a password manager. For accounts that support it, add two-factor authentication on top.
Frequently asked questions
How long should a password be?
Length matters more than complexity. 16 random characters from a mixed set is strong for almost anything, and a password manager means you never need to remember it.
Are these passwords really random?
Yes. They use your browser's cryptographically secure random generator (crypto.getRandomValues) with rejection sampling to avoid bias, and every selected character type is guaranteed to appear (which costs a fraction of a bit of entropy at short lengths).
Is anything sent to a server?
No. Passwords are generated and checked entirely on your device, and nothing is stored or logged.
What does "bits of entropy" mean?
It measures unpredictability. Each extra bit doubles the number of guesses an attacker needs. Above about 80 bits is considered strong against offline attacks.