Password Generator

Strong passwords, generated privately

This tool builds random passwords using your browser's cryptographically secure random number generator — the same class of randomness used for security-sensitive work. Choose a length and which character types to include, and it assembles a password that's genuinely hard to guess. Nothing is ever sent over the network, so the password exists only on your screen until you copy it.

What makes a password strong

Two things drive strength: length and unpredictability. Each extra character multiplies the number of possible combinations an attacker must try, and mixing character sets widens the pool per character. A random 16-character password drawn from all four sets is astronomically harder to crack than a short or dictionary-based one.

Using generated passwords safely

• Never reuse a password across sites — one leak shouldn't unlock everything.
• Store them in a password manager so you don't have to remember them.
• Enable two-factor authentication wherever it's offered for a second layer of defense.

How to create and use a strong password

1. Set the length to 16 or more. Length is the single biggest factor in strength — each extra character multiplies the possible combinations.
2. Include all four character sets — uppercase, lowercase, numbers and symbols — to widen the pool per character.
3. Generate and copy the password, then paste it straight into the sign-up or password-change form.
4. Save it in a password manager so you never have to memorise or reuse it.
5. Turn on two-factor authentication on the account for a second layer that a stolen password alone can't bypass.

Why length beats complexity

Password strength is measured in entropy — the number of guesses an attacker would need. Adding length grows that number exponentially, which is why a long passphrase of random words can be stronger than a short string of symbols. A truly random 16-character password drawn from all four sets has so many combinations that brute-forcing it is infeasible with today's hardware, whereas an 8-character one can fall in hours.

The weak point is rarely the math — it's reuse. When one site is breached, attackers replay that email-and-password pair against banks, email and shopping sites ("credential stuffing"), so a unique password per account contains the damage. For the full picture, see how to create a strong password, and when you need to hash or encode a value, try the hash generator or Base64 encoder.

Frequently asked questions