Password Generator
Create a strong random password or a memorable passphrase. Everything happens on your device — no password is ever transmitted or logged.
How strong passwords are measured here
The strength meter estimates entropy (bits of randomness) from the character set size and length you choose, not just length alone. A 12-character password using only lowercase letters is far weaker than a 12-character password mixing upper/lowercase, numbers, and symbols — the meter reflects that difference.
Passphrases (a sequence of random words) are often easier to remember than a string of random characters while still being hard to guess, provided you use enough words — we recommend at least 4.
Frequently asked questions
How long should my password be?
For anything important — email, banking, your password manager's master password — aim for at least 16 characters with a mixed character set, or a 5+ word passphrase. Shorter passwords can still be fine for low-value, rarely-reused accounts, but length is the single biggest lever for resisting brute-force guessing.
Password or passphrase — which is more secure?
Both can be equally secure if they're long enough — what matters is total entropy (bits of randomness), not which style you pick. A passphrase of 5+ random words is often easier to remember and type correctly (especially on mobile) than an equivalent-strength string of random characters, which is why we recommend at least 4-5 words if you go that route.
Is it actually safe to generate a password in my browser?
Yes. This tool uses the Web Crypto API's crypto.getRandomValues(), which is a cryptographically secure random number generator built into your browser — the same class of randomness used for things like TLS. Nothing you generate here is transmitted anywhere or logged; it exists only in your browser tab.
What are "ambiguous characters" and why would I exclude them?
Characters like 0/O, 1/l/I, and similar look-alikes can be hard to tell apart in some fonts — useful to avoid if you'll be reading the password aloud, typing it from a printed slip, or entering it on a device with a small or unusual font. Excluding a handful of characters barely reduces overall entropy, so it's on by default; uncheck it if you want the absolute maximum character space.
How much entropy (bits) do I actually need?
As a rough guide: under 36 bits is weak (crackable quickly with modern hardware), 36-59 bits is moderate (fine for low-stakes accounts), 60-79 bits is strong, and 80+ bits is very strong — appropriate for anything sensitive. The strength meter above updates live as you change length and character-set options.
Can I reuse a generated password across multiple accounts?
No — always generate a unique password per account. If one site has a data breach, reused passwords let attackers try the same credentials everywhere else (called credential stuffing). Use a password manager to store unique generated passwords without needing to remember each one.