Password Generator

Generate a password

Generate new password

How it works

Every password is generated entirely within your browser using the Web Cryptography API (crypto.getRandomValues()). This function is provided by your operating system's cryptographically secure pseudo-random number generator (CSPRNG) — the same source used for TLS keys and other security-critical operations.

The character set you select determines the pool from which each position is drawn. A 20-character password using all four sets (lowercase, uppercase, digits, symbols) draws from a pool of roughly 94 characters, giving approximately 131 bits of entropy — well beyond what any current hardware can brute-force in any practical timeframe.

No network request is made. The page can be saved and used offline without loss of functionality.

Tips

• Use a password manager. A generated password is only useful if you can retrieve it. Store it in a trusted manager rather than memorising it or writing it in plaintext.
• Longer is almost always better. Length contributes more to entropy than character set variety. A 20-character lowercase-only password has more entropy than a 10-character mixed-set one.
• Different password for every account. The main risk from a strong password is reuse — if one site is breached, all your accounts with the same password are exposed.
• Check the strength bar. Aim for "Strong" or "Very Strong" for any account that matters. "Fair" is acceptable for low-value sites.