Strong password generator (browser only)
Generate a strong, random password with optional upper case, digits, and symbols. Uses crypto.getRandomValues when available.
How to use this password
Save it in a password manager (Bitwarden, 1Password). Do not paste it into chat or email. Length matters more than characters — 16+ is recommended.
Why length beats complexity
A password's strength comes from its length times the number of possible characters. Going from 8 to 16 characters multiplies the search space far more than adding exotic symbols does. A random 16-character password mixing lower, upper, digits and symbols is beyond any realistic brute-force attack today, while "P@ssw0rd!" — symbols and all — falls in seconds because it follows a pattern attackers try first. Randomness and length are what matter; this tool provides both.
How random is this generator?
On modern browsers the tool uses crypto.getRandomValues, the
browser's cryptographically secure random number generator — the same source
used for HTTPS keys. If that API is unavailable, it falls back to
Math.random and tells you so in the output. The generator never
sends the password anywhere; it exists only in your browser tab.
Do's and don'ts
- Do use a unique generated password for every account, kept in a password manager such as Bitwarden or 1Password.
- Do prefer 16+ characters for anything that matters: email, banking, cloud storage.
- Don't reuse a strong password across sites — one breach then unlocks all of them.
- Don't send generated passwords over chat or email.
FAQ
Are generated passwords stored anywhere?
No. Generation happens in your browser; nothing is transmitted or saved. If you close the tab, the password is gone unless you copied it.
What length should I choose?
16 is a good default; 20+ for high-value accounts. Beyond that, usability in password managers matters more than extra characters.
Why can't I use only symbols or only digits?
You can — uncheck the other sets. But single-set passwords are weaker at the same length, so the tool requires at least one set to be selected.
People also use this for…
Every tool below is also 100%% local: no upload, no account, no server copy — the same privacy guarantee you get on this page.
- Format the config you are pasting it into
Validate the JSON before you save it. - Share it as a QR code
Generate the code locally, with nothing sent anywhere. - Read why none of this is uploaded
The architecture explanation, in plain language.
How to generate a password
- Set the length. Sixteen characters is a good default; twenty or more for anything that protects money or identity.
- Tick the character sets you need: upper case, lower case, digits, symbols. Most sites require at least three of the four.
- Click Run and copy the result straight into your password manager — do not retype it, and do not paste it into a chat window.
- Generate a fresh one for every account. Reuse is the single biggest password risk, far bigger than any question of complexity.
Where the randomness comes from
The generator draws from crypto.getRandomValues, the browser's
cryptographically secure random number generator, which is seeded from your
operating system's entropy pool. That is categorically different from
Math.random, which is a fast but predictable algorithm unsuitable
for secrets. In practical terms: an attacker who watches a hundred passwords from
this page still cannot predict the hundred-and-first. Generation happens entirely
on your device — nothing is sent anywhere, nothing is logged, and there is no
record of what was generated once you close the tab.
How strong is "strong"?
Password strength is measured in bits of entropy, roughly
length × log2(character set size). A 12-character password from
letters and digits is about 71 bits; 16 characters from all four sets is about
104 bits. Anything above roughly 80 bits is beyond brute-force reach with current
hardware. Notice that length does more work than symbols: adding four characters
buys far more security than swapping in punctuation. If a site rejects your
symbols, generating a longer letters-and-digits password is not a downgrade.
Sensible rules around generated passwords
- Use a password manager. Nobody can remember 20 random characters, and they should not have to.
- Never reuse a generated password across sites; one breach then compromises everything else.
- Do not store it in a screenshot or a note app that syncs unencrypted. A password manager's vault is the right place.
- Turn on two-factor authentication wherever it is offered — it protects you even if a password leaks.
- Beware of "password strength" meters on the site you are signing up to; many reward pointless rules (forced rotation, mandatory symbols) over actual entropy.
Troubleshooting
- The site rejects my password: it probably caps length (some banking sites still do) or bans certain symbols. Try 16 characters with letters and digits only.
- It contains a character I cannot type: regenerate, or use copy-paste rather than typing it.
- I lost it: there is no recovery. This page keeps no copy — use the account's reset flow and store the new one in your manager.
- Looks like it repeated a character: that is expected and fine. Filtering out repeats would actually weaken the password.
FAQ
Can I generate the same password again?
No, and that is by design. If a password could be regenerated from a seed you remember, so could anyone else's guess at that seed.
Is it safe to use on a work computer?
Yes — the password never touches the network, so nothing appears in proxy logs or browser history beyond the page visit itself.
Should I change passwords regularly?
Current guidance says no: change them when there is a breach or a reason to suspect one, not on a fixed calendar. Length and uniqueness matter far more.