Password Generator

What makes a password strong?

Length beats cleverness. Every added character multiplies the number of guesses an attacker needs, so a random 16-character password is astronomically stronger than a "complex" 8-character one. Use 16+ characters wherever allowed, a different password for every account, and a password manager so you don't have to remember any of them.

Frequently asked questions

Could anyone see the passwords generated here?

No. Passwords are produced by crypto.getRandomValues() — your browser's cryptographically secure generator — and exist only on your screen. Nothing is transmitted, logged, or stored; we couldn't see them if we wanted to.

What do the strength ratings mean?

The rating is based on entropy — the number of equally likely possibilities. 80+ bits is effectively uncrackable by brute force with current technology; 60–80 bits is strong for online accounts with rate limiting.

Should I exclude look-alike characters?

Only if you'll ever type the password by hand (e.g. a Wi-Fi key). It slightly reduces entropy, so leave it off for passwords stored in a manager.