How to generate a strong password
- Drag the Length slider to your target, the number readout updates live, and 16 or more is a sensible floor for real accounts.
- Toggle the four character-set checkboxes, A–Z, a–z, 0–9 and !@#$ symbols, to match what the site you're signing up for allows. The strength bar under the field reacts to every change.
- Press ↻ Regenerate until you have one you like; each press draws a brand-new random password on the spot.
- Click Copy password and paste it into your password manager. If you'll ever read the password aloud or type it on a TV or console, tick Exclude look-alikes so you never confuse
I,l,1,Oand0.
Here is the part that matters most: this password is created on your own device and is never transmitted, logged or stored anywhere. A lot of "password generator" websites build the password on their server and send it back to your browser, which means your brand-new secret has already traveled across the internet, and possibly through their logs, before you have used it once. This tool does the opposite. It runs entirely in local JavaScript using crypto.getRandomValues, the browser's built-in cryptographic random number generator (the same source of randomness password managers and encryption libraries rely on). The password exists only in the text field and on your clipboard. Nothing is uploaded, and there is no server that ever sees it.
The generator also guarantees that every character set you leave enabled shows up at least once, so a password meant to include a symbol will never come back symbol-free just because randomness got unlucky. That matters because sites enforce rules like "must contain a number and a special character," and a password that technically passes your settings but fails theirs wastes a round-trip. Because none of this depends on the network, you can load the page, switch to airplane mode, and keep generating passwords with no connection at all, proof that nothing is leaving your machine.
What actually makes a password strong
Strength comes from entropy, a measure, in bits, of how many guesses an attacker would need to try. Every extra bit doubles that work, and entropy grows with both the length of the password and the size of the character pool you draw from. A 16-character password using upper- and lowercase letters, digits and symbols packs roughly 100 bits, which is far beyond what current hardware can brute-force in any realistic timeframe. Length is the biggest lever: adding characters helps more than adding exotic symbols. What ruins an otherwise strong password is human patterns, a dictionary word, a birth year, a keyboard walk like qwerty, or reusing the same one everywhere. Random generation sidesteps all of that, and pairing it with a password manager means you never have to memorize the result, so length costs you nothing.
Frequently asked questions
Is this password generator actually safe?
Yes. Passwords are generated on your device with the browser's cryptographic random number generator (crypto.getRandomValues) and are never transmitted, logged or stored. There is no server involved in creating them, and you can prove it by going offline after the page loads and generating away, it still works.
How long should my password be?
16 characters with mixed character sets (~100 bits of entropy) is a strong default for everyday accounts. Bump it to 20 or more for high-value logins like email, banking and your password manager's master password, since a breach of those cascades into everything else.
What does the strength bar and entropy figure mean?
Entropy estimates how many guesses an attacker would need, each added bit doubles it. Roughly 60+ bits resists online guessing, while 80+ bits holds up against fast offline cracking of a stolen database. The bar is a quick visual read of that number as you change length and character sets.
Should I turn on "Exclude look-alikes"?
Turn it on whenever the password will be typed or read by a human, dictated over the phone, entered on a smart TV, or copied from paper, because it removes the easily confused I, l, 1, O and 0. Leave it off for passwords that live only in a manager, so you keep the largest possible character pool.
Do I need every character type switched on?
Enable as many as the target site permits, more character types widen the pool and raise entropy. Some sites reject certain symbols, so if a password is rejected, uncheck !@#$ and add a few characters of length instead, which recovers the strength you lost.
Is it safe to generate the same password twice?
Each password is drawn independently from cryptographic randomness, so regenerating gives you a completely unrelated string, never reuse one across sites. If you need unique identifiers rather than secrets, the UUID Generator produces random v4 IDs the same private way.