Password generator
Strong random passwords from 8 to 64 characters, generated on your device.
Generate truly random passwords using the browser’s own cryptographic generator (crypto.getRandomValues). Pick the length and character sets, see the estimated strength in bits of entropy and copy with one click. Since everything runs locally, no password ever travels over the internet — not even we can see it.
What makes a password strong
A strong password is long and unpredictable. Length matters more than complexity: each extra character multiplies the time an attack would need to guess it. Mixing uppercase and lowercase letters, numbers and symbols raises that difficulty further. The generator creates truly random passwords with the length and character types you choose — far safer than any password a person could think up.
Why generate (and not invent)
Human-made passwords follow predictable patterns: a name, a date, "123", swapping "a" for "@". Modern attacks test billions of these combinations per second. A random password has no pattern to exploit. Best practice is a different password for each service, stored in a password manager — so if one site leaks, the others stay safe.
Generated only in your browser
Passwords are created locally with the browser’s own cryptographic generator (crypto.getRandomValues) and are never transmitted — nothing travels over the network. Copy and use them safely. To store hashes or check integrity, see the hash generator.
Frequently asked questions
What makes this password secure?
It comes from crypto.getRandomValues, the browser’s cryptographic random number generator — the same one used for HTTPS connections. Unlike Math.random(), it is unpredictable and suitable for security.
What length should I use?
For everyday accounts, 16 characters with letters, numbers and symbols (~100 bits) is already excellent. For password-manager master passwords, use 20 or more. Length matters more than swapping letters for look-alike symbols.
Is the generated password transmitted or saved?
No. It is born and dies in your browser’s memory. We use no network, cookies or storage — reload the page and the previous password is unrecoverable.