Password Generator

Create strong, random, secure passwords with cryptographically secure randomness. Set the length, pick character types, read the strength meter, and copy in one click — nothing leaves your browser.

Generating…
16
Free, no sign-up Generated in your browser Web Crypto secure

How to Generate a Strong Password

Three steps, all in your browser.

1

Set the length

Drag the slider to choose how many characters you want, from 4 up to 64. Longer is stronger — 16 or more is a good default for most accounts.

2

Pick character types

Toggle uppercase, lowercase, numbers and symbols. Each type you enable is guaranteed to appear and widens the pool, which the strength meter reflects live.

3

Copy and save

Copy your password with one click and paste it into the sign-up form or your password manager. Generate a fresh one anytime — nothing is ever uploaded. Need a code instead? Try the QR Code Generator.

Frequently Asked Questions

How does this password generator work?
The generator builds a password by drawing random characters from the character types you have enabled — uppercase letters, lowercase letters, numbers and symbols. Crucially, it uses the Web Crypto API's cryptographically secure random number generator rather than the ordinary Math.random function, which is not safe for security purposes. It also guarantees that at least one character from each type you selected appears in the result, then shuffles everything so the guaranteed characters are not predictably placed. Every part of this happens locally in your browser: the password is created on your own device and is never sent to, stored on, or logged by any server. Change the length or options and a fresh password is generated instantly.
What makes a password strong?
Two things: length and unpredictability. Length matters most — each extra character multiplies the number of possible combinations, so a long password is dramatically harder to crack by brute force than a short one. Unpredictability means the characters are genuinely random and not based on words, names, dates or keyboard patterns that attackers test first. Mixing character types (uppercase, lowercase, numbers and symbols) enlarges the pool each character is drawn from, which raises strength further. As a practical rule, aim for at least 16 characters with several character types enabled. The strength meter on this page estimates these factors live as you adjust the length and options, moving from Weak through Fair and Strong to Very strong.
How long should my password be?
For most accounts, 16 characters with a mix of character types is a strong, practical choice and the default here. For high-value accounts — your email, password manager, banking, or anything protecting other accounts — consider 20 characters or more. Some sites cap the maximum length or disallow certain symbols; if a password is rejected, reduce the length or turn off symbols and generate again. Because a password manager remembers passwords for you, there is no penalty for making generated passwords long and random — you never have to type or recall them. This tool supports any length from 4 up to 64 characters, so you can match each site's rules while staying as strong as it allows.
Are these passwords actually random and safe?
Yes. The randomness comes from crypto.getRandomValues, the browser's built-in cryptographically secure pseudo-random number generator, which is designed for security-sensitive use and is unpredictable even to someone who knows the code. The tool also avoids modulo bias — a subtle flaw that can make some characters slightly more likely than others — by discarding and re-drawing values that would skew the distribution. Just as important, everything runs client-side: the password is assembled in your browser and never transmitted, so there is no server that could see or keep it. The safest workflow is to generate a password here and save it straight into a password manager, rather than reusing or lightly editing an old one.
Should I use symbols in my password?
Generally yes — adding symbols widens the set of possible characters, which makes each character carry more entropy and the whole password harder to guess. However, some websites and older systems reject certain symbols or limit which ones they accept. If a freshly generated password is refused at sign-up, the simplest fix is to turn off the symbols option and increase the length by a few characters instead; a longer letters-and-numbers password can be just as strong as a shorter one with symbols. With a password manager doing the remembering, you can comfortably keep symbols on for the sites that allow them and reserve the letters-and-numbers mode for the few that do not.
Does the password leave my device or get stored?
No. The generator is fully client-side, which means the password is created in your browser and never sent over the network, never written to a server, and not saved by this page after you leave. There is no account, no sign-in and no analytics tied to the passwords themselves. When you click Copy, the password goes to your system clipboard so you can paste it into a sign-up form or password manager; for safety, paste it where you need it promptly and avoid leaving it on the clipboard longer than necessary. Refreshing or closing the tab discards the generated password entirely, so nothing lingers once you are done.