Password Generator
Strong random passwords from your browser's cryptographic random source — configurable, with a strength estimate, and never sent anywhere.
Select at least one character type.
What makes a password strong
Strength is math: pool size to the power of length. Each additional character multiplies the number of possible passwords — which is why a long password from a smaller pool usually beats a short "complex" one. The generator draws every character independently from the browser's cryptographic random source, so there are no patterns to exploit.
Set length and types
16+ characters with all four types is a solid modern baseline for important accounts.
Generate
Every option change produces a fresh password instantly; ↻ rolls a new one anytime.
Copy into a manager
Copy the password straight into a password manager — one unique password per account.
Local generation you can verify
A fair question for any online password tool: does the site see my password? Here the answer is verifiably no — generation uses crypto.getRandomValues in your browser, and nothing is transmitted. You can prove it yourself: load the page, disconnect from the internet, and generate. It still works, because everything happens on your device. The strength label estimates entropy from pool size and length; "excluding ambiguous characters" trims the pool slightly, so compensate with a little extra length when a password has to be readable from paper.
Frequently asked questions
How long should a strong password be?
16 characters or more with mixed character types is a solid modern baseline. Length matters more than complexity: every added character multiplies the effort to crack it.
Is it safe to generate a password on a website?
Here, yes: the password is generated locally in your browser with crypto.getRandomValues and never transmitted anywhere. You can verify this by loading the page and turning off your internet before generating.
What does "exclude ambiguous characters" do?
It removes characters that look alike — 0 and O, 1, l and I — which helps when a password must be read from paper or typed on a TV. It slightly reduces the character pool, so add length to compensate.
Should I reuse a strong password across sites?
No. If one site leaks, every account with that password is exposed. Use a unique password per account and a password manager to store them.