Free online tool
Password Generator
Generate strong, random passwords using your browser's cryptographic RNG. Nothing is sent, stored, or logged.
What makes a password strong
Password strength comes down to two things: length and unpredictability. A 20-character password drawn from a random mix of letters, digits and symbols has astronomically more possible combinations than an 8-character password with a birthday and an exclamation mark. Modern guidance from NIST and the UK's NCSC both prioritize length over complexity rules that force specific character types.
Why this generator is safe
The tool uses crypto.getRandomValues, the browser's cryptographically secure random number generator — the same API used by many password managers and encryption libraries. The generated password never leaves your device, is not logged anywhere, and disappears the moment you close the tab. Copy it straight into your password manager and you're done.
+How long should my password be?
For most accounts, 16 characters or more is comfortably safe against brute force for the foreseeable future. For high-value accounts, 20+ is a sensible baseline.
+Should I memorize generated passwords?
No. Use a password manager. That's the whole point — one strong master password protects a vault of strong, unique passwords you never have to remember.
The math behind a password that actually resists guessing
Password strength is entropy, measured in bits, not vibes. A generator's job is to draw characters from a cryptographically secure random source across a wide enough alphabet that brute-forcing the result takes longer than anyone cares to wait.
Length and character variety both feed into that entropy calculation, but they aren't interchangeable, and neither matters at all if the underlying randomness is weak. Knowing which lever actually moves the needle helps you set sane defaults instead of copying whatever a company's password policy demands without understanding why.
Counting the bits
Entropy is roughly length times log2(alphabet size). A 12-character password using lowercase only draws from 26 symbols and gives about 56 bits; add uppercase, digits, and symbols to widen the alphabet to roughly 94 characters and the same length jumps to about 79 bits. Going from 12 to 16 characters at that full alphabet size pushes you past 100 bits, which is the difference between crackable on consumer hardware within your lifetime and not crackable with anything we currently know how to build.
Randomness source matters more than character variety
A password built from Math.random() in older JavaScript engines pulls from a pseudo-random generator that isn't designed for security use and can theoretically be predicted if an attacker recovers enough output. A tool worth using generates values via the Web Crypto API's getRandomValues, which draws from the operating system's cryptographic entropy pool, the same source used for TLS keys.
A gotcha worth knowing
Excluding ambiguous characters like 0, O, l, and 1 makes a password easier to type from a screen but shrinks the alphabet and therefore the entropy — for anything stored in a password manager and never typed manually, skip that option and keep the full character set for maximum strength.
Passphrases versus random strings
A four-word Diceware-style passphrase drawn from a 7,776-word list gives roughly 51 bits for four words, comparable to a shorter random string but far easier for a human to memorize and type without a manager. Passphrases trade some raw entropy density for memorability, which is a reasonable trade for a master password you'll type by hand, but a poor choice for the dozens of site-specific passwords a manager can just store and autofill instead.
Why site-specific rules can weaken a strong password
Some legacy sites cap password length at 16 or even 8 characters, or forbid certain symbols outright, both of which cut directly into the entropy a generator can provide. When a site imposes those limits, compensate by maximizing whatever character variety is still allowed rather than assuming the length alone was doing all the work.
People also search for
- random password generator
- strong password creator
- secure password generator online
- password entropy calculator
- generate passphrase
- cryptographically secure random password
- password strength bits
- custom password length generator