How to generate a password
- A 16-character password appears right away.
- Adjust Length and the character types. Turn on Avoid look-alikes if you’ll type it by hand.
- Click Copy and paste it into the sign-up form or your password manager.
How it works
Each character is picked with crypto.getRandomValues, the browser’s cryptographically secure random generator, not with Math.random. We use rejection sampling so that every character is exactly equally likely, and we make sure each chosen type appears at least once before shuffling.
The passwords are created in this tab and are never stored or sent anywhere. Close the tab and they’re gone.
What the numbers mean
Strength is measured in bits of entropy: length × log2(number of possible characters). With all four types there are 87 characters, so 16 characters give about 103 bits, 12 characters about 77 bits and 8 characters about 51 bits.
The time shown assumes an attacker testing 10 billion guesses per second against a leaked, fast-hashed password database, and finding it after searching half the possibilities. At that rate an 8-character password with all types falls in about 2 days, 12 characters take around 300,000 years, and 16 characters are out of reach. Real attacks are often slower, but this is a sensible worst case.
When to use it
Signing up for a new service. Replacing a password that was reused or appeared in a data breach. Setting a Wi-Fi password for guests. Creating initial passwords for a team, using How many to make up to 20 at once.
To share a Wi-Fi password without reading it out, put it into a code with QR Code Generator.
Good to know
- Use a different password for every site and keep them in a password manager. That matters more than any single password’s strength.
- Some sites reject certain symbols. If a form complains, turn off Symbols and add 2–3 characters of length instead.
- Turn on two-factor authentication wherever it’s offered; a strong password alone doesn’t stop phishing.
Frequently asked questions
Is it safe to generate a password on a website?
Here, yes: the password is made by your browser’s secure random generator, in this tab, and isn’t sent anywhere. You can disconnect from the internet and it still works.
How long should my password be?
At least 12 characters with mixed types; 16 or more for email, banking and your password manager’s master password.
What are look-alike characters?
Characters easy to confuse when read or typed: lowercase l, uppercase I, digit 1, uppercase O, digit 0 and similar punctuation. Avoiding them slightly reduces strength, so add a character or two.
Do you store the passwords?
No. Nothing is saved, not even in your browser’s storage.