What is a Password Generator?
Password strength is entropy — how many guesses an attacker needs. Human-invented passwords are predictable; 16 random characters from a full charset (~100 bits) are effectively unguessable.
This generator uses your browser’s cryptographic random source with unbiased sampling, guarantees at least one character from each chosen set, and shows an honest entropy estimate. The password is generated on your device — it is never transmitted, stored or seen by us.
Where the generated password should go: a password manager, immediately. The manager remembers it, fills it, and makes per-site unique passwords practical — which matters because credential stuffing (trying your leaked password everywhere) is how accounts actually fall. One strong memorized passphrase for the manager, generated randomness for everything else.
How to use the Password Generator
- Pick a length and the character sets.
- Click Generate Password.
- Copy it straight into your password manager.
Frequently asked questions
What about passphrases like correct-horse-battery-staple?
Excellent for the few passwords you must type from memory: five random words carry ~64 bits and are far easier to enter on a TV keyboard. For everything a manager fills, generated characters win.
Should I rotate passwords regularly?
Modern guidance (NIST) says no — forced rotation breeds weak patterns. Change a password when there is a reason: a breach notification, shared access ending, or suspicion.
How long should a password be?
16+ random characters for anything that matters. Length beats cleverness — every added character multiplies the search space.
Is it safe to generate passwords on a website?
Here, yes: generation uses crypto.getRandomValues locally and the password never leaves your device. We could not log it if we wanted to.
What do the “bits” mean?
Entropy: log2 of possible passwords. ~50 bits is crackable with effort; 70+ strong; 90+ effectively unbreakable today.
Should I avoid symbols for sites that reject them?
Untick symbols and add length instead — 20 alphanumeric characters beat 14 with symbols.