Password Generator
Generate strong passwords locally in your browser. Nothing is transmitted, logged or stored, so the password you see is yours alone.
Passphrase
What actually makes a password strong
Strength is measured in entropy — the number of equally likely possibilities an attacker must search. It is length × log₂(alphabet size). Length dominates: adding one character to a 62-symbol alphabet multiplies the search space by 62, while adding symbols to a fixed-length password barely moves the needle.
| Entropy | Verdict |
|---|---|
| < 40 bits | Weak — crackable in minutes by a modern GPU rig |
| 40–60 bits | Fair — acceptable only with rate limiting behind it |
| 60–80 bits | Strong — suitable for most online accounts |
| 80+ bits | Very strong — appropriate for password managers, encryption keys and admin accounts |
Passwords vs passphrases
A random 16-character password from a 94-symbol alphabet carries about 104 bits of entropy but is impossible to remember. A five-word passphrase drawn from a 2,000-word list carries about 55 bits and you can memorise it in a minute. Use a passphrase for the handful of secrets you must type from memory — your device login and your password manager's master password — and let the manager generate long random strings for everything else.
Rules that no longer apply
Current NIST guidance drops the old advice to force mixed character classes and rotate passwords every 90 days. Both push people toward predictable patterns such as Summer2024!. What matters instead: reasonable length, no reuse across sites, screening against known breached passwords, and multi-factor authentication.
Practical checklist
- Use a unique password for every account — reuse is what turns one breach into ten.
- Store them in a password manager rather than a notes app or spreadsheet.
- Turn on multi-factor authentication wherever it is offered; it defeats most credential-stuffing attacks outright.
- Never send a password over email or chat. If you must share one, use a one-time secret link.
Frequently asked questions
Is it safe to generate a password on a website?
On this one, yes — the generator runs entirely in your browser using crypto.getRandomValues(), and the page has no backend to send anything to. You can verify by loading the page, disconnecting from the network, and generating passwords offline.
How long should a password be?
Sixteen random characters is a good default for online accounts. Go to 20 or more for password-manager master passwords, encryption keys and anything protecting other credentials.
Should I include symbols?
They help, but far less than length. A 20-character letters-and-digits password is stronger than a 12-character one with symbols, and it avoids sites that quietly reject certain punctuation.
What does "exclude look-alikes" do?
It removes characters that are easy to confuse when read aloud or transcribed — 0/O and 1/l/I. Useful for passwords you will type by hand or dictate; it slightly reduces entropy per character.
Do I still need to change passwords regularly?
Only when there is a reason — a breach notification, a shared password, or a suspicion of compromise. Scheduled rotation without cause mostly produces weaker, more predictable passwords.