Choose a length and character types, then generate a random password. Everything happens locally using your browser's secure random number generator.
Runs entirely in your browser — nothing you type here is sent to our server.
Most password breaches don't come from someone cleverly guessing a password character by character — they come from automated tools trying enormous lists of previously leaked passwords and common patterns (a name plus a birth year, a keyboard walk like “qwerty123”, a word with a symbol tacked on) across every account they can find. A password assembled from truly random characters has no pattern to exploit, so an attacker is left with brute force: trying every possible combination, which becomes impractically slow once the password is long enough.
That's why length matters more than most people expect. Each additional random character multiplies the number of possible passwords, while adding “complexity” rules to a short, human-chosen password barely helps, since people apply those rules in predictable ways an attacker's tools already account for. A 20-character random password from a modest character set is typically far stronger than an 8-character one stuffed with substitutions.
The practical way to use long, unique, random passwords everywhere is a password manager: it generates and remembers them for you, so the only password you need to memorize is the one that unlocks the manager itself. This tool covers the generation half of that; most password managers include a similar generator built in, but a browser-based one is handy for one-off cases, like setting up a router, a shared Wi-Fi network, or an account you're creating for someone else.
Written from what each site tells us about itself and how the directory works — see something off? Let us know.
Each character is chosen using the browser's Web Crypto API (crypto.getRandomValues), the same cryptographically secure random number source browsers use for things like generating encryption keys. That's a meaningfully stronger source of randomness than Math.random(), which many simpler password generators use and which isn't designed to be unpredictable.
Longer is almost always better than more complex. A random 16-character password drawing from a large character set is far harder to guess or brute-force than an 8-character one, even if the shorter one mixes cases, numbers, and symbols. Where a site allows it, 16 characters or more is a reasonable default; use the maximum length a site accepts for your most sensitive accounts.
It estimates entropy — roughly, how many attempts a brute-force search would need on average to land on your exact password, based on its length and the size of the character set you selected. It assumes the password is genuinely random, which is true for anything this tool generates; a human-chosen password of the same length is typically far weaker, since people tend to pick predictable patterns.
The option removes characters that are easy to misread or mistype, like the digit 0, the letter O, the digit 1, the lowercase l, and the uppercase I. It's useful for a password you'll need to type by hand or read off a screen; leave it unchecked for a password you'll only ever copy-paste, since it slightly reduces the character set.
The generator runs entirely in your browser's JavaScript engine and never sends the result anywhere — there's no network request involved in generating or displaying it. As with any password manager or generator, use it on a device you trust, and store the result in a reputable password manager rather than writing it down in plain text.
No. Using a different, independently generated password for every account limits the damage if one site is ever breached. A password manager makes this practical by remembering each one for you, so you only need to recall a single master password.
