Password Generator
Create random passwords that are hard for people to guess, for new accounts or when changing an old password. Passwords are generated in your browser and are never sent or stored anywhere.
Passwords are made in this browser with cryptographic randomness (crypto.getRandomValues) and are never sent or stored.
How passwords are generated
Each character is picked with your browser's cryptographic random number generator (crypto.getRandomValues). One character from every selected type is chosen first, the rest are filled in, and the whole password is shuffled again. Modulo bias, which would make some characters appear more often, is removed.
What does strength (bits) mean?
The strength of a random password is length × log₂(number of possible characters) bits. A 16-character password using lowercase, uppercase, numbers and symbols has about 100 bits, which is practically impossible to guess. Below 40 bits is shown as Weak, below 60 as Fair, below 80 as Strong, and above that as Very strong.
Using passwords safely
Making a password longer raises its strength more than adding symbols. Use at least 12 characters, and 16 or more for important accounts. Use a different password for every site, store them in a password manager rather than in notes or messages, and turn on two-factor authentication.
FAQ
What if a site doesn't allow symbols?
Turn off symbols and add 2-3 characters to the length to keep a similar strength.
Why exclude similar-looking characters?
It removes characters that are easy to confuse, such as uppercase I, lowercase l and 1, or O and 0, so you make fewer mistakes when typing a password by hand. Strength drops only slightly.
Are generated passwords stored?
No. They are never sent to a server and disappear when you refresh the page. Copy the one you use straight into a password manager.
Everything runs inside your browser. Files and text you use with this tool are never uploaded or stored on a server.