How long should a password be?

For regular accounts: at least 16 characters with a mixed character set. For critical accounts (email, banking, password manager master): 20+ characters. Length matters more than complexity, 20 random lowercase letters are safer than 8 characters with everything.

Is it safe to generate passwords in the browser?

Yes, as long as the browser uses `crypto.getRandomValues()` (which this page does), the randomness is cryptographically secure. The password never leaves your device. What is unsafe is using `Math.random()`, or online services where the password is sent to a server.

Should I include symbols?

Yes, if the site allows it, it increases entropy per character. But some systems reject certain characters (spaces, ` `, `'`). If you get an error, turn off symbols and increase length instead. Length beats complexity almost every time.

How do I remember all these passwords?

You don’t, use a password manager (Bitwarden, 1Password, KeePass). You remember one strong master password, and the app fills in the rest automatically. This is the single most important security habit you can adopt.

Password generator

How it works

Passwords are made with cryptographically secure randomness (crypto.getRandomValues) locally in your browser, they are never sent anywhere. Multi-word passphrases are easy to remember and still strong.

About this tool

A password generator creates strong, random passwords that are practically impossible to guess or brute-force. The key is entropy, the longer and more varied the password, the more combinations an attacker must try. This tool generates passwords using `crypto.getRandomValues()`, the browser’s cryptographically secure random source, much stronger than plain `Math.random()`. You choose length and character set (uppercase, lowercase, numbers, symbols), and the password is generated locally in your browser and never sent over the network.

How to use it

Choose the desired length, 16 characters is a good minimum for important accounts, 20+ for critical ones.
Tick the character sets you want (uppercase/lowercase, numbers, symbols).
Click "Generate", a new password is created instantly with cryptographic randomness.
Copy the password with one click and store it in a password manager.
For multiple passwords, click generate multiple times, each one is independently random.

Examples

Strong (20 chars, all sets)

OutputkR8#mP2$vN9!qL4&xY7@

~130 bits of entropy. A modern GPU would take billions of years to brute-force this.

Passphrase (4 random words)

Outputcorrect-horse-battery-staple

From the classic XKCD comic. ~44 bits of entropy, weaker than 20 random chars, but much easier to remember. Good for a password manager master password.

PIN (digits only, 8 digits)

Output73921648

Only ~27 bits of entropy, usable only where attempts are rate-limited (like SIM cards that lock after 3 wrong).

Common use cases

Making unique passwords for every account (never reuse!).
Generating API keys or shared secrets for services.
Creating master passwords for password managers like Bitwarden or 1Password.
Quickly rotating compromised passwords after a data breach.
Setting temporary passwords for new users or test accounts.
Generating strong Wi-Fi passwords for home or office networks.

Frequently asked questions

How long should a password be?: For regular accounts: at least 16 characters with a mixed character set. For critical accounts (email, banking, password manager master): 20+ characters. Length matters more than complexity, 20 random lowercase letters are safer than 8 characters with everything.
Is it safe to generate passwords in the browser?: Yes, as long as the browser uses `crypto.getRandomValues()` (which this page does), the randomness is cryptographically secure. The password never leaves your device. What is unsafe is using `Math.random()`, or online services where the password is sent to a server.
Should I include symbols?: Yes, if the site allows it, it increases entropy per character. But some systems reject certain characters (spaces, `<`, `>`, `'`). If you get an error, turn off symbols and increase length instead. Length beats complexity almost every time.
How do I remember all these passwords?: You don’t, use a password manager (Bitwarden, 1Password, KeePass). You remember one strong master password, and the app fills in the rest automatically. This is the single most important security habit you can adopt.

Technical background

`crypto.getRandomValues()` uses the operating system’s secure entropy source (`/dev/urandom` on Unix, `CryptGenRandom` on Windows). With an alphabet of N characters, each character has `log₂(N)` bits of entropy, 62 characters (a-z, A-Z, 0-9) gives 5.95 bits per character, with symbols typically over 6.5. A 20-character password from a full alphabet gives 130+ bits of entropy, well above the NIST recommendation of 112 bits. For comparison, AES-128 keys have 128 bits of security. Even at 100 billion guesses per second, brute force would take longer than the age of the universe.