Password Generator
Generate strong, random passwords with the length and character types you choose. Free, instant and private — passwords are created with your browser's cryptographically secure random generator and never leave your device.
How to generate a strong password
- Choose a length. Drag the slider to set how many characters you want. Longer passwords are exponentially harder to crack — 16 characters or more is a good target for important accounts.
- Pick character types. Turn lowercase, uppercase, numbers and symbols on or off. Enable "exclude similar characters" if you want to avoid look-alikes like the letter O and the number 0.
- Copy your password. A new password is created instantly. Press Copy to put it on your clipboard, or use Generate list to create several at once and download them.
About this tool
This free password generator builds unpredictable passwords using crypto.getRandomValues, the same cryptographically secure random number generator browsers use for encryption keys. Unbiased rejection sampling guarantees every character in the pool is equally likely, so there are no weak patterns to exploit. When you select more than one character type, the generator also guarantees at least one character from each type you enabled, so a password can never accidentally leave out the symbols or digits a site requires.
Everything happens locally in your browser. Your generated passwords are never uploaded, logged or stored on any server, and the page keeps working even if you go offline after loading it. The strength meter estimates entropy in bits from the length and the size of your chosen character set, giving you a quick sense of how resistant a password is to brute-force guessing.
Frequently asked questions
Are these passwords really random and secure?
Yes. They come from crypto.getRandomValues, your browser's cryptographically secure pseudo-random number generator, and the tool uses rejection sampling to avoid the modulo bias that naive random code often introduces. This is far stronger than everyday functions like Math.random().
Are my passwords sent anywhere or saved?
No. Passwords are generated entirely on your device with JavaScript. Nothing is transmitted to a server, and nothing is stored after you close the page, so it is safe to generate credentials for sensitive accounts.
How long should my password be?
For most online accounts, 16 characters mixing upper- and lowercase letters, numbers and symbols is very strong. For high-value accounts or encryption keys, aim for 20 or more. The entropy readout under the password tells you roughly how strong each one is — above 80 bits is considered strong.
Why would I exclude similar characters?
Look-alikes such as the capital letter O and the digit 0, or the lowercase L and the digit 1, are easy to confuse when you have to read or type a password by hand. Excluding them slightly reduces the character pool but makes passwords less error-prone to transcribe.