Create strong, random passwords. Generated with the browser’s crypto API — never leaves your device.
How this password generator works
Strong passwords depend on two things: length and unpredictability. This generator builds each character using the browser’s crypto.getRandomValues API — the same cryptographically secure source browsers use for encryption keys. It is not the ordinary Math.random(), which is predictable and unsafe for secrets.
You control the length, and you can toggle four character sets: uppercase letters, lowercase letters, digits and symbols. Longer passwords with more sets selected produce dramatically more combinations, which is what makes them hard to crack. A 16-character password using all four sets would take centuries to brute-force.
Common uses
- New accounts — create a unique password for every website so one breach can’t unlock the rest.
- Wi-Fi and routers — set a strong network key that isn’t a dictionary word.
- Shared secrets — generate one-time codes to hand to a colleague or family member.
- Passphrases — switch to the word-based mode for passwords you actually need to type by hand.
Frequently asked questions
Can you see the passwords I generate?
No. Everything is created and displayed locally in your browser. Nothing is sent to a server or stored anywhere.
How long should my password be?
12 characters is a reasonable minimum today; 16 or more is better for important accounts like email and banking.
Are passphrases as safe as random passwords?
Yes, if they are long enough. Four or more random words are both memorable and extremely hard to guess.
Should I include symbols?
Symbols help, but length matters more. If a site rejects symbols, just use a longer password without them.
How often should I change passwords?
Only when there is a reason — a known breach, a reused password, or a suspicious login. Forcing routine changes of already-strong passwords tends to make people pick weaker, more predictable ones.
Why length beats symbols
Most password advice in circulation was written for an era of eight-character passwords and quarterly change policies. Both ideas have aged badly. Modern cracking hardware tries billions of guesses per second against a stolen hash, and it does not try them one at a time — it tries them in the order real people pick them. That is the whole problem, and it is why length matters more than the number of symbol keys you reach for.
The maths is blunt. Adding one lowercase letter multiplies the search space by twenty-six. Adding one symbol to an existing eight-character password multiplies it by roughly the number of symbols available, then hands most of that back if the symbol ends up in a predictable place — a trailing exclamation mark, a capital first letter, a 1 where an i should be. Crackers try those substitutions first, precisely because they are popular.
A sixteen-character password drawn from lowercase letters alone is harder to guess than an eight-character password using every keyboard symbol. It is also far easier to type on a phone, which matters more than people admit: a password that is annoying to enter is a password that gets reused, written on a sticky note, or downgraded the first time a site demands a reset.
What actually makes a password weak
Almost every real-world breach traces back to one of five causes. None of them is “the attacker guessed a long random string”.
- Reuse. The single largest cause. One site leaks, and automated tools try that address and password pair everywhere else within minutes. A unique password per site is the one habit that matters most.
- Shortness. Anything under twelve characters falls to a determined attacker far faster than most people expect, even when it looks complicated.
- Predictable construction. Capital first letter, digits appended, symbol appended. Attackers model this explicitly and those candidates are tested early.
- Personal detail. Names, dates and pet names are in every wordlist worth using, and they are also the first thing a person who knows you will try.
- Offline capture. When a database is stolen, the attacker gets unlimited time with the hash. This is the scenario a password manager and a long random string are built for.
A practical setup
Use a password manager, and let it generate sixteen or more characters for every account you do not have to type by hand. That covers the overwhelming majority of your logins, and you never have to think about them again. If you already have accounts with weak passwords, change the ones that guard money and identity first — email above all, because it is the reset route for everything else.
For the handful of passwords you must actually memorise, use a passphrase rather than a random string. Four or five unrelated words from a large list give you both length and memorability, and they survive being typed on a phone keyboard. Switch the tool above to passphrase mode for those.
Skip the ritual password change. Rotating a strong, unique password on a schedule does not help, and it reliably makes people choose something simpler. Change a password when there is a reason: a breach notice, a reused password you are cleaning up, or a login you do not recognise.
How length changes the search space
| Password | Alphabet | Combinations | Verdict |
|---|---|---|---|
| 8 lowercase letters | 26 | 268 | Too short |
| 12 lowercase letters | 26 | 2612 | Adequate floor |
| 16 lowercase letters | 26 | 2616 | Strong, easy to type |
| 12 mixed case + digits | 62 | 6212 | Good |
| 16 mixed case + digits | 62 | 6216 | Very strong |
| 4 random words | 7,776 each | about 252 | Strong and memorable |