Password Generator
Generate a random, secure password with the character types you choose.
Generating…Okay
About this calculator
Generate a Strong, Random Password
This free password generator creates secure, random passwords right in your browser. Nothing is sent over the internet and nothing is stored: the password is built on your device and disappears when you close the page. Choose a length and which character types to include — uppercase letters, lowercase letters, numbers and symbols — and copy the result straight into your password manager or sign-up form.
What Makes a Password Strong?
Password strength is a measure of how many guesses an attacker would need on average to find it, either by guessing likely candidates or by trying every combination in a brute-force attack. Three things drive it:
- Length — the biggest factor. Every extra character multiplies the number of possible passwords. Aim for at least 12–16 characters.
- Variety — mixing lowercase, uppercase, numbers and symbols enlarges the pool of characters each position can use.
- Unpredictability — random strings beat anything based on names, birthdays, pets, keyboard patterns or dictionary words, because attackers try those first.
Best Practices for Using Passwords
- Use a different password for every account. If one site is breached, reused passwords hand attackers the keys to everything else.
- Use a password manager so you only have to remember one strong master passphrase.
- Turn on two-step verification wherever it is offered. Even a leaked password is much less useful without the second factor.
- Do not share passwords by email or chat, and avoid saving them in plain-text notes.
- Change a password right away if you suspect a breach, and watch for phishing messages that ask you to "verify" your login.
Passwords vs. Passphrases
A passphrase made of four or more random, unrelated words can be long and easy to remember while still being hard to crack — handy for the few passwords you must type from memory, such as a device login or a password manager's master key. For everything else, a generated random string is the safest choice.
Security Controls Matter Too
A strong password is only one layer. Account lockouts after repeated failed attempts, alerts for new sign-ins and up-to-date devices all reduce the damage if a password is ever exposed. If you are generating random values for something other than a login, the Random Number Generator may fit better.
Worked example
A 16-character password drawing from all four character types has roughly 102 bits of entropy — far beyond what any realistic brute-force attempt could crack with current or near-future computing power.
Frequently asked questions
Is this password actually random?
Yes — it's generated using your browser's cryptographically secure random number generator (crypto.getRandomValues), the same class of randomness used for encryption keys, not a predictable pseudo-random function.
Does the password ever leave my browser?
No — it's generated and displayed entirely client-side. Nothing about it is sent to or stored on a server.
Why include symbols and mixed case if length matters more?
Both matter: length increases possible combinations exponentially, but each added character type multiplies the pool of characters per position too — combining a longer password with more character types gives the best protection.
Should I reuse a strong password across sites?
No — use a unique password per site (ideally via a password manager). A single leaked password reused everywhere lets an attacker into every account that shares it, no matter how strong it is.
