How this works

Passwords here are generated using window.crypto.getRandomValues() — the Web Cryptography API built into every modern browser. This is a cryptographically secure pseudorandom number generator (CSPRNG), the same class used for TLS key generation, cryptographic signing, and other security-critical operations. It is fundamentally different from Math.random(), which is a non-cryptographic PRNG that produces predictable sequences if an attacker knows the seed.

Nothing typed or generated on this page is sent anywhere. The password exists only in your browser's memory until you copy it or close the tab.

What makes a password strong

Password strength comes down to entropy — how many possible values an attacker would have to try before guessing correctly. Two things drive entropy: length and character set size.

Length

Each additional character multiplies the number of possible passwords by the size of the character set. A 16-character password from a 94-character set (uppercase + lowercase + digits + common symbols) has 94¹⁶ ≈ 3.7 × 10³¹ possible values. Modern guidance from NIST and most security researchers prioritises length over complexity.

Character set

Using uppercase, lowercase, digits, and symbols gives 94 possible characters per position. Using only lowercase letters gives 26. The difference: a 12-character all-lowercase password has 26¹² ≈ 95 billion combinations; a 12-character mixed password has 94¹² ≈ 475 trillion. The mixed set is roughly 5,000× harder to brute-force at the same length.

Randomness

Human-chosen passwords are predictable — people use dictionary words, names, dates, and patterns. A randomly generated password from this tool has no such biases; every position is independently and uniformly selected from the character set.

Password guidance by use case

High-value accounts (banking, email, primary accounts)

Use the longest password the service allows, with all character types enabled. 20+ characters. Store it in a password manager — there's no need to memorise it.

Accounts that require memorisation

A passphrase (4–6 random words) is often more memorable and equally or more secure than a shorter random string. For example, "correct-horse-battery-staple" is 28 characters and extremely hard to crack.

Sites with character restrictions

Some sites disallow special characters or have maximum length caps (often a sign of poor security practices on their part). Adjust the length and symbol settings accordingly and generate until you have something within their constraints.

Temporary or shared passwords

Even temporary passwords should be random. A generated 12-character password is far safer than "Welcome123!" for an account you're handing off to someone.

Frequently asked

How long should a password be?

Current NIST guidance (SP 800-63B) recommends at least 8 characters minimum, with 16+ recommended for most accounts. For high-value accounts where the password is stored in a manager, the longer the better — 20–32 characters is reasonable and adds no practical usability cost when you're not typing it manually.

Is it safe to generate passwords in a browser?

This tool uses the browser's CSPRNG and runs entirely client-side with no network requests. It is safe in the sense that the generated password never leaves your device. That said, if your device is compromised (malware, keylogger, clipboard monitoring), no browser tool can protect against that — which is also why a dedicated password manager with its own secure storage is the more robust long-term approach.

Should I use a different password for every site?

Yes — this is one of the most impactful security habits. If one site's database is breached and passwords are cracked, attackers try the same credentials on every other site. Unique passwords per site means a breach at one place can't cascade into others. A password manager makes this practical.

What are the symbols included?

The symbol set is: !@#$%^&*()_+-=[]{}|;':",<>?/ — the printable non-alphanumeric ASCII characters that most sites accept. If a particular site rejects one of these, generate a new password and try again; statistically you're unlikely to hit a rejected character twice in a row.