Click GenerateGenerate strong passwords instantly
This free password generator creates cryptographically random passwords right in your browser using the Web Crypto API — the same secure randomness trusted by security applications. Adjust the length and character types to match any site’s requirements.
What makes a password uncrackable?
Length and randomness. A 16-character password mixing all four character types is effectively impossible to brute-force with today’s technology. We’ve excluded easily-confused characters (like 0/O and 1/l) so your password stays readable when you need to type it.
Store them safely
A strong password is only useful if you don’t reuse it. Generate a unique one for every account and store them in a password manager — see our 2026 password manager comparison to pick the right one.
What makes a generated password better than one you invent
Humans are reliably bad at randomness. Asked to pick a random string, people cluster around keyboard patterns, names, dates, capitalised first letters and a symbol at the end. Attackers know this, and modern cracking tools model those habits directly rather than brute-forcing blindly. That is why a password you invented that feels random usually is not, and why a generated one of the same length is substantially stronger.
This generator draws from the browser Web Crypto API via crypto.getRandomValues(), which is a cryptographically secure pseudo-random number generator seeded by the operating system entropy pool. That is a meaningfully different thing from Math.random(), which many simple generators still use. Math.random() is not designed to be unpredictable and its output should never be used for anything security-related.
How length and character set combine
Password strength is entropy, and entropy is length × log2(character set size). With all four character types enabled the set is roughly 95 characters, worth about 6.57 bits each. So a 12-character password carries about 79 bits, 16 characters about 105 bits, and 20 characters about 131 bits.
Note what happens when you disable symbols: the set drops to 62 characters and 5.95 bits per character. Losing half a bit per character sounds trivial, but across a 16-character password it is the difference between roughly 105 and 95 bits. Adding two characters recovers more than turning symbols back on does — which is the general rule with passwords. When in doubt, add length.
When to exclude ambiguous characters
Excluding lookalike characters such as l, I, 1, O and 0 slightly shrinks the character set and therefore slightly reduces entropy. It is worth doing anyway in one specific case: when a human will have to read the password off a screen and type it somewhere else, such as a router credential, a Wi-Fi key on a printed card, or a temporary account handed to a colleague. Add two characters of length to compensate and you come out ahead on both counts.
For anything going straight into a password manager, leave ambiguous characters in. Nobody is reading it aloud.
Generating is the easy half
A generated password only helps if it is stored somewhere you can retrieve it, which means a password manager. A long random password written on a sticky note or kept in a plain text file on the desktop is not an upgrade. The practical setup is one strong memorised passphrase protecting a manager, with every other credential generated, unique and never seen by you.
Frequently asked questions
Are these generated passwords sent to a server?
No. Generation happens entirely in your browser using the Web Crypto API. No password is transmitted, logged or stored, and there is no server request involved at any point. Load the page, disconnect from the internet, and it still generates.
How long should my password be?
Sixteen characters with all types enabled is a sound default for ordinary accounts, giving around 105 bits of entropy. Go to 20 or more for a password manager master password, disk encryption, or anything that protects other credentials. Below 12 characters is not worth generating.
Is a random string or a passphrase better?
Random strings are stronger per character and belong in a password manager. Passphrases are far easier to type and recall, so they belong wherever a human has to enter the password from memory — your manager master password, your device login, your disk encryption. Use both, in the right places.
Can I reuse a generated password across a few accounts?
No. Reuse is the weakness that actually gets exploited at scale: one breached site exposes every account sharing that password, and credential-stuffing attacks automate exactly this. Strength does not help if the password leaks in plaintext from somewhere else. Generate a fresh one per account.
Does the browser remember what was generated here?
Nothing is written to storage by this tool — no cookies, no localStorage, no history. Once you close or refresh the tab the generated value is gone. Copy it into your password manager before navigating away. See our 2026 password manager comparison if you do not have one yet.