Password Generator

How to generate a strong password

Most people pick passwords like "Summer2024!" — easy to remember but trivial for an attacker to guess. A truly strong password looks like nothing in particular: a string of random characters with no recognizable pattern. This tool builds exactly that, using your browser's cryptographic random number generator. The result is statistically as unpredictable as it can possibly be.

Step 1 — Choose a length

Drag the length slider. For an account that holds something valuable — bank, email, work — use at least 16 characters. For accounts with two-factor authentication enabled, 12 is acceptable. For anything you'd be devastated to lose, use 20 or more. Our generator supports up to 128 characters.

Step 2 — Pick which character types to include

Uppercase, lowercase, numbers, and symbols are all on by default. The more variety, the stronger the password. Some old systems reject certain symbols, so if a site complains, turn off the special characters checkbox and regenerate.

Step 3 — Copy and save

Click the password field to copy it, then paste into the site or app where you're signing up. The best practice: save it directly into a password manager (Bitwarden, 1Password, Apple Keychain, etc.). Don't try to memorize random passwords — that's what password managers are for.

Why our password generator is different

Lots of websites generate passwords. The problem with most: you have no idea what they do with the password after generating it. A generator that logs the passwords it makes — even just to a server access log — has effectively given an attacker a head start.

Passwords are generated entirely in your browser. We use the Web Crypto API (window.crypto.getRandomValues), which is the same source of randomness that browsers use for encryption keys. Nothing is sent to our servers. Nothing is logged. Nothing is even stored — once you close the tab, the password we generated is gone unless you saved it elsewhere.

Cryptographically secure randomness. Not Math.random() — that's predictable in some browsers and unsuitable for security use. The Web Crypto API is what real cryptography uses.

No accounts, no tracking, no upselling. We don't try to sell you a password manager, an antivirus, or a VPN.

When to use a generated password

• Every new account you create. Reusing passwords across sites is the single biggest mistake in password security. One leaked site exposes every other account that shares the password. A unique generated password per site fixes this entirely.
• Replacing weak passwords on important accounts. If your email or bank uses something memorable, that's a vulnerability. Replace it.
• One-time use codes shared with someone. Sharing temporary access? Generate a password, share it, then delete and rotate after they're done.
• Wi-Fi passwords. Routers often ship with weak default Wi-Fi passwords. Replace yours with something generated and strong.
• Master passwords for password managers. Counterintuitively, this is one place where a strong generated string isn't ideal — you actually need to memorize it. For that, use a passphrase (5+ random words) instead.

What makes a password actually strong?

The math is simple. A password's strength is measured in "bits of entropy" — essentially, how many possible passwords an attacker would have to try to be sure of finding yours. Each random character adds entropy: about 6 bits for a lowercase letter, ~7 for mixed case, ~7.5 with numbers, ~6.5 per character if you include symbols too. As a rough guide:

• 8 random mixed characters — roughly 50 bits — crackable in hours by a serious attacker with modern hardware
• 12 random mixed characters — roughly 78 bits — secure for almost any individual account today
• 16 random mixed characters — roughly 104 bits — secure against everything realistic, including state-level attackers
• 20+ random mixed characters — roughly 130+ bits — overkill for most uses, appropriate for very high-value targets

The other factor that matters: predictability. "Password123!" technically has 12 characters and a symbol, but its entropy is essentially zero because it's a common pattern. Real strength comes from randomness, not length alone.

Best practices once you have a strong password

• Use a password manager. Trying to remember 50 unique passwords is impossible, so people either reuse or write them on sticky notes. A manager solves both. Bitwarden is free and open-source; 1Password is excellent paid. Both are far better than what you'd otherwise do.
• Turn on two-factor authentication everywhere it's available. Even with a perfect password, 2FA adds a second lock. Apps like Authy, Google Authenticator, or hardware keys are stronger than SMS-based 2FA.
• Don't email passwords to yourself. If your email account is compromised, every password sitting in your inbox is, too.
• Change passwords if a site you use has been breached. Sites like haveibeenpwned.com track this. If your address shows up in a breach, rotate the relevant password.
• Don't share passwords through chat, screenshots, or sticky notes. Use the password manager's sharing feature if you must, or a secure one-time-link service.

Frequently asked questions

Everything you might want to know before you use the tool.