How this password generator works
Every character is chosen with crypto.getRandomValues, the secure random generator built into your browser, not the weak Math.random that many simple tools use. A technique called rejection sampling removes the tiny bias that would otherwise favour some characters. Nothing is sent to a server, nothing is saved, and the page keeps working with the internet off, so your new password exists only on your screen.
Password or passphrase?
- Password: best when a password manager types it for you. 16 characters with all sets is very strong.
- Passphrase: best when you must type or remember it, such as your phone lock, email or Wi-Fi. Five random words give roughly 41 bits from this list size, six give about 49, so use seven or eight with a number for your most important accounts.
Safe habits
- Use a different password for every account, especially email, because email can reset all the others.
- Turn on two-step verification for Gmail, Facebook, WhatsApp and your banking apps.
- Never share an OTP or password with anyone who calls you, even if they say they are from the bank.
Need a QR code so guests can join your Wi-Fi without typing? Use the QR Code Generator.
Frequently asked questions
Is it safe to generate a password on a website?
Here, yes. The password is created by your own browser using crypto.getRandomValues, the same secure random source that browsers use for encryption. It is never sent over the internet, never saved and never logged. You can switch off your internet after the page loads and it will still work.
How long should my password be?
For important accounts such as email, banking and mobile wallets, use at least 14 characters or a passphrase of 5 words or more. Longer is better than complicated: a long passphrase is both stronger and easier to type on a phone than a short password full of symbols.
What is a passphrase and is it really strong?
A passphrase is several random words joined together, for example river-lamp-orange-stone-eagle. Because the words are picked at random from a list, the strength is measured honestly: this tool shows the exact bits of strength based on the size of its word list. Five words is good for most accounts; use six or seven for your main email.
How do I remember my passwords?
Do not try to remember dozens. Remember one strong passphrase for your email and for a password manager (or your phone's built-in one, such as Google Password Manager), and let it store the rest. Never save passwords in WhatsApp chats or in plain notes anyone can open.
What does the strength meter mean?
It shows entropy in bits: how many guesses an attacker would need on average. Under 40 bits is weak, 60 is fair, 80 is strong and above 100 is excellent. It assumes the password was picked randomly, which is true for what this tool makes and not true for words you choose yourself.