This creates strong, random passwords using your device's actual random number generator, not a predictable pattern. You control the length and which character types are included, so you can match a site's specific requirements while still getting genuine randomness.
How to use it
- Set the password length with the slider.
- Turn uppercase, lowercase, numbers, and symbols on or off depending on what's required.
- Click generate.
- Click generate again as many times as you want.
- Copy the password once you're happy with it, and store it in a password manager.
When it helps
- Creating a unique password for a new account instead of reusing one from somewhere else.
- Meeting a site's specific complexity requirements, like needing a symbol and a number.
- Setting a strong Wi-Fi password that you're not trying to remember, just store safely.
- Replacing a weak or exposed password after a breach notification.
- Generating temporary passwords for a shared account or a new user.
Good to know
- Use a unique password for every account rather than reusing one across sites.
- Store generated passwords in a real password manager instead of trying to remember them.
- Aim for at least 16 characters where a site allows it. Length matters more than adding extra symbol types.
- Avoid generating a password with only numbers if a site allows it. Mixing in letters and symbols where possible increases the number of guesses an attacker would need.
- If a site restricts which symbols are allowed, generate a longer password with only letters and numbers instead of fighting with the symbol restrictions, since length matters more anyway.
Questions
How random are these passwords, really?
This uses your browser's built in cryptographically secure random number generator, the same kind used for security sensitive operations, not a simpler and more predictable random function.
Is it safe to generate a password in a browser?
Yes, generation happens entirely on your device using your browser's local randomness, and the password is never sent anywhere or stored on a server.
What length password should I use?
Longer is generally better. Many current recommendations suggest at least 12 to 16 characters, and a password manager makes long, unique passwords practical for every account.
Why exclude symbols from a generated password?
Some older systems or forms don't accept certain symbols, so turning that option off lets you generate something still strong but compatible with a stricter requirement.
Should I change my passwords periodically?
Current guidance generally favors long, unique, randomly generated passwords over frequent mandatory changes, and prioritizes changing a password right away if there's any sign it's been exposed.
Can I generate a password that's easy to type on a phone keyboard?
Turning off symbols makes a password easier to type on a phone, though it's a small trade against strength. A long letters and numbers password is still quite strong.