Password Generator
Generate a random, secure password with the character types you choose.
Generating…Okay
About this calculator
How This Password Generator Works
Choose a length and which character sets to include — uppercase, lowercase, numbers, and symbols — and the generator produces a random password using your browser's cryptographically secure random number source. Nothing is sent to a server: the password is generated, displayed, and never transmitted or stored anywhere.
What Makes a Password Strong
- Length matters more than complexity — a 16-character password from a smaller character set is typically harder to crack than a 10-character password with every character type mixed in, because length increases the search space exponentially.
- Randomness beats patterns — substituting "a" with "@" or appending "123!" to a familiar word is a well-known pattern that password-cracking tools already account for; true randomness has no such shortcut.
- Uniqueness per site — reusing a password across multiple accounts means a single leaked database compromises every account using that password. A password manager makes unique, random passwords for every site practical without needing to memorize them.
A Note on Security
This tool uses the Web Crypto API's cryptographically secure random number generator, not a predictable pseudo-random function — the same class of randomness source used for cryptographic keys. Still, for your most sensitive accounts, consider a dedicated password manager, which can also store and autofill unique passwords without you needing to remember them.
Worked example
A 16-character password drawing from all four character types has roughly 102 bits of entropy — far beyond what any realistic brute-force attempt could crack with current or near-future computing power.
Frequently asked questions
Is this password actually random?
Yes — it's generated using your browser's cryptographically secure random number generator (crypto.getRandomValues), the same class of randomness used for encryption keys, not a predictable pseudo-random function.
Does the password ever leave my browser?
No — it's generated and displayed entirely client-side. Nothing about it is sent to or stored on a server.
Why include symbols and mixed case if length matters more?
Both matter: length increases possible combinations exponentially, but each added character type multiplies the pool of characters per position too — combining a longer password with more character types gives the best protection.
Should I reuse a strong password across sites?
No — use a unique password per site (ideally via a password manager). A single leaked password reused everywhere lets an attacker into every account that shares it, no matter how strong it is.