Generate strong random passwords with custom length and character sets, using cryptographic randomness.
Strength:—
Online password generator
Reused or short passwords are the number-one cause of account takeovers. This password generator uses the browser cryptographic RNG to create hard-to-guess, strong random passwords with a custom length and character set — all locally, nothing sent anywhere.
How to use
Choose the password length.
Tick the character types to include (uppercase, lowercase, numbers, symbols).
Click Generate, then copy it straight into your password manager.
Security tips
Use a unique password per site with a password manager.
Enable two-factor authentication (2FA) on important accounts.
Never store passwords in plain-text files or chat messages.
Longer beats fancier — and let a manager remember it
The real point of a generator is to give every site its own long, random password so you can finally break the habit of reusing one everywhere — that way a single breach doesn't hand attackers the keys to all your accounts. One myth worth clearing up: length matters more than complexity. A long string of random characters is usually far harder to crack than eight characters stuffed with symbols, and it holds up much better against brute-force guessing. And don't try to keep these in your head or in a plain text file — pair the generator with a password manager that stores and autofills them, or convenience will pull you straight back to bad habits.
What is the word "Strong" based on?
On arithmetic you can redo yourself. The page defaults to length 16 with a pool of 62, and the readout says Strong because 16 × log2(62) is about 95 bits. Turn symbols on and the pool reaches 87 (26 + 26 + 10 + 25 symbols). The password itself is random and not reproducible; the entropy is the part you can check. A generator that will not tell you its pool size gives you no way to verify its strength claim.
Where the randomness comes from
Random source
crypto.getRandomValues() — the browser's cryptographic generator, not Math.random()
Leaves your device
no: the password is generated locally and never sent anywhere
Stored
no: nothing is written to a server, and nothing is logged
The source of randomness is the part that actually matters. Math.random() is predictable enough that passwords built from it can be reconstructed; crypto.getRandomValues() is not, and that is what this page uses. After that, length does more work than exotic characters: adding a character multiplies the search space, while swapping one letter for a symbol barely moves it. The one thing a generator cannot do is help you remember the result — which is the real argument for a password manager.
The password is random; the strength is arithmetic
The default settings, with the numbers behind the rating.
length 16
character pool 62
entropy ~95 bits
rating Strong
The password itself cannot be reproduced, but the strength can: entropy is length × log₂(pool), so 16 × log₂(62) ≈ 95 bits. You can check that on any calculator. The rating thresholds are fixed too — under 45 bits is weak, under 75 fair, above that strong. Turning on symbols raises the pool and adds a few bits; adding length adds far more.
Frequently Asked Questions
Are these passwords secure?
Yes. They use the browser-native crypto.getRandomValues() cryptographic RNG and are generated locally on your device — never uploaded or stored.
How long should a password be?
For most accounts, aim for at least 16 characters mixing upper/lowercase, numbers and symbols. Longer resists brute force better; use 20+ for important accounts.
Should I reuse passwords?
No. Use a unique password per site and store them in a password manager, so one breach cannot compromise your other accounts.
