Password Generator
Generate strong, random passwords instantly. Customise length and character types, check password strength, or generate bulk passwords for multiple accounts.
What makes a strong password?
A strong password has at least 12–16 characters and combines uppercase letters, lowercase letters, numbers, and symbols. Avoid using real words, names, dates of birth, or sequences like "123456" or "abcdef".
Best practices: Use a different password for every account. Never reuse passwords. Use a password manager to store them safely. Enable two-factor authentication (2FA) wherever possible.
How random is this generator? All passwords are generated using the browser's built-in crypto.getRandomValues() API — the same cryptographic randomness used by banks and security software. Your password is never sent to any server.
What actually makes a password strong
Most advice about "strong" passwords is misleading. Swapping an a for an @ or adding one number does almost nothing against the way passwords are really broken. What matters is how many possibilities an attacker would have to work through — and a few clear principles get you there.
Length beats complexity
Every character you add multiplies the number of possible combinations, so length increases difficulty far faster than sprinkling in symbols does. A long password built from a random mix of letters, numbers, and symbols is dramatically harder to crack than a short one, even a short one full of special characters. If you can only remember one rule, make it longer. This generator lets you push length well past the bare minimum most sites accept.
Passphrases: strong and actually memorable
The real danger isn't guessing — it's reuse
How this generator keeps you safe
Every password is created on your own device, inside your browser, and is never sent to or stored on any server — so there's no copy of it anywhere for anyone to intercept. You can generate, copy, and use it without the string ever leaving your screen.
Habits that matter more than any single password
- Use a unique password for every important account — especially email, which can reset everything else.
- Let a password manager remember them so length and uniqueness cost you no effort.
- Turn on two-factor authentication wherever it's offered; even a leaked password is far less useful without the second factor.
- Change a password promptly if a service tells you it was involved in a breach.
- Never share a one-time code (OTP) with anyone who calls or messages you — no genuine bank or company will ever ask for it, and handing it over defeats even a strong password.
Frequently asked questions
How long should my password be?
Longer is better, and length helps more than adding symbols. Go well beyond a site's minimum where you can — a generated password of many random characters is far stronger than a short complex one.
Are the passwords stored anywhere?
No. They are generated entirely in your browser and are never transmitted or saved on a server, so no copy exists outside your own screen.
Is a passphrase safer than a password?
A passphrase of several random, unrelated words can be both long and memorable, which makes it a strong and practical choice. What matters is total length and randomness, not whether it's words or characters.
Why shouldn't I reuse passwords?
Because a breach at any one site exposes that password, and attackers automatically try the same email-and-password pair on other services. A unique password per account limits any breach to a single site.
Do special characters really help?
They widen the pool of possible characters a little, but adding length widens the possibilities far more. Use symbols if a site requires them, but don't rely on them in place of a genuinely long password.