Password Generator
Create strong, truly random passwords — generated on your device with cryptographic randomness, never sent anywhere.
—
Options
About this tool
The passwords people invent are the passwords attackers guess first. This free generator creates strong random passwords using your browser's cryptographically secure random number generator — the same class of randomness password managers rely on. Pick a length, choose which character sets to include, and copy the result.
Because generation happens entirely on your device, the password exists only in your browser's memory until you copy it — it is never transmitted, logged or stored. Pair it with a password manager and use a unique password for every account.
How to generate a strong password
- Set the length — 16+ characters is a strong default.
- Choose character sets. More variety means more strength; keep at least two sets.
- Hit Generate until you get one you like, then Copy it into your password manager.
Frequently asked questions
Can anyone see the passwords generated here?
No. Passwords are generated on your own device using your browser's built-in cryptographic random number generator and are never transmitted anywhere. We could not see them even if we wanted to.
How long should my password be?
16 characters with mixed character types is a strong modern default — effectively uncrackable by brute force. Use 20 or more for anything critical like a password manager master password or an email account.
Is this really random?
Yes — it uses the Web Crypto API (crypto.getRandomValues), the same cryptographically secure source password managers use, not the predictable Math.random function found in casual generators.
What does the exclude ambiguous option do?
It removes characters that look alike in many fonts — such as capital O and zero, lowercase l, capital I and the digit one — which helps when a password must be read aloud or typed from paper.
Should I still use a password manager?
Yes. Generate a unique password per site and store them in a reputable password manager. Reusing even a strong password across sites is the biggest real-world risk, because one leaked site exposes all the others.