Password Generator
Strong random passwords generated in your browser, at four lengths. Nothing is sent anywhere and nothing is stored.
Four fresh passwords, generated on your own machine. Pick a length, copy it, and press Generate again for a new set.
16 characters — letters, digits, symbols
A sensible default for almost anything.
24 characters — letters, digits, symbols
For an email account, a password manager, or anything holding the keys to the rest.
20 characters — no lookalike characters
No O/0, I/l/1. For a password you have to read aloud or type from paper.
32 characters — letters and digits only
For systems that reject symbols. Extra length makes up for the smaller alphabet.
About this tool
How to Choose a Strong PasswordLength beats complexity, uniqueness beats both, and rotating every 90 days makes things worse. What actually protects an account, and why.
Free download
Password & Account Security ChecklistThe habits that matter, in order of how much they protect you. Print it, work through it once, and it stays done.
Free, no email required — print it or save it as a PDF.
Share it
Password Generator infographicThe key numbers as one image — free to save, share, or embed on your own site with credit.
How this works
Each password is drawn from crypto.getRandomValues, the browser's cryptographic random source. Math.random is deliberately not used: it is fast and predictable, which is fine for shuffling a playlist and unacceptable for a password. Characters are chosen by rejection sampling rather than by taking a remainder. Taking a remainder biases the result towards the earlier characters of the alphabet whenever 256 does not divide evenly by the alphabet size, which quietly makes a password weaker than its length suggests. The alphabets differ by row. The 16 and 24 character rows use letters, digits and symbols. The unambiguous row leaves out characters that are easy to misread when typing from a screen or a written note: capital O and zero, capital I, lowercase l and the digit one. Everything happens in your browser. No password is transmitted, logged or stored, and reloading the page discards them.
Common questions
- Is this actually safe to use?
- The generation happens in your browser using the operating system's cryptographic random source, and nothing is sent over the network. You can prove that: open your browser's network tab and press Generate again, and you will see no request.
- How long should a password be?
- Sixteen random characters is comfortably beyond guessing for anything you will meet in practice. Length matters more than exotic symbols, which is why the letters-and-digits row here is 32 rather than 16.
- Why does one row leave characters out?
- Because O and 0, and I, l and 1, are hard to tell apart in many fonts. If a password will be read off a screen, written down or dictated, removing them prevents an entire category of failed logins.
- Do I need to change passwords regularly?
- Current guidance says no, not on a schedule. Forced rotation pushes people towards small predictable edits. Change a password when there is a reason to: a breach, a shared device, or any suspicion it leaked.
- What should I do with it?
- Put it in a password manager. A generated password is only strong if it is unique to one account, and nobody remembers dozens of unique random strings.
Last updated
Get the next tool.
New tools and guides straight to your inbox. No spam, ever.