Password generator
Strong, random passwords made in your browser. Your password is never sent or saved.
Your password:
or press Space
Your password never leaves this page
There is no server step. The page you loaded does all the work, and the result exists only on your screen until you copy it.
Made by your browser
Every character comes from
crypto.getRandomValues, the same random source your browser uses for encryption.Never sent or saved
Passwords are never transmitted, logged or stored, and they are hidden from our usage analytics. Your settings, like length, stay on this device.
Works offline
Once the page has loaded, you can disconnect from the internet and keep generating passwords.
How long should a password be?
Each extra character multiplies the number of possible passwords by 89. Length matters more than anything else.
| Characters | Entropy | Time to try every combination |
|---|---|---|
| 8 | 52 bits | 11 hours |
| 10 | 65 bits | 9.9 years |
| 12 | 78 bits | 78,000 years |
| 16 | 104 bits | 4.9 trillion years |
| 20 | 130 bits | 3 × 1020 yearsDefault |
Assumes random characters from all four sets (89 characters) and an attacker with dedicated hardware making 100 billion guesses per second. Real attacks on well-protected sites are much slower.
Questions
Is it safe to use an online password generator?
It is safe when the password is created on your own device and never sent anywhere. This page generates every password in your browser with crypto.getRandomValues. No password is transmitted or stored.
How long should my password be?
Use at least 16 characters for accounts that matter. With letters, numbers and symbols, 16 random characters would take trillions of years to guess at 100 billion guesses per second.
Should I use a different password for every account?
Yes. When one site leaks its passwords, attackers try the same email and password on other sites. A unique password for each account stops one leak from opening the rest. A password manager can remember them for you.
What does “Avoid look-alikes” do?
It removes characters that are easy to confuse in many fonts: capital I, lowercase l, the digit 1, capital O, the digit 0 and lowercase o. Use it when you need to read a password aloud or type it from a screen.
Do you see or keep the passwords I generate?
No. Passwords are generated by JavaScript running on this page and are never sent to a server. They are also hidden from the analytics tool we use to improve the site. Your settings, such as length and character types, are kept in your browser.