Password Generator
Generate strong, random passwords with configurable length and character sets.
Create strong, random passwords using a cryptographically secure random source. Choose the length and which character sets to include. Generated entirely on your device.
—Generated locally with a cryptographically secure random source. Nothing is transmitted.
Drag the length slider to choose how many characters you need (4 to 64), then toggle lowercase, uppercase, digits, and symbols depending on what the target site requires. Press Generate to create a new password using your browser's secure random source, and use the copy button to place it on your clipboard without retyping it.
Formula & methodology
Characters are drawn uniformly from the selected sets using crypto.getRandomValues.
Common mistakes
- Choosing a short length (under 12 characters) while several character sets are enabled — it still looks random, but shorter passwords are far easier to brute-force.
- Reusing the same generated password across multiple accounts instead of generating a unique one for each site.
- Turning off digits or symbols for convenience, then having the password rejected by a site that requires at least one of each character type.
Frequently asked questions
Are these passwords stored?
No. They are generated in your browser and never transmitted or saved.
How long should a password be?
16 characters or more with mixed character types is a strong baseline.
Is a randomly generated password actually secure enough for real accounts?
Yes. It's built from crypto.getRandomValues, the same cryptographically secure random source browsers use for encryption keys — not Math.random(), which isn't safe for generating passwords.
Why did a website reject the password I generated?
Some sites limit which symbols they accept or require at least one character from every set. Toggle the symbols set off, or regenerate with all sets enabled, to match the site's rules.
Can I reuse one generated password for several accounts?
It's best not to. Generate a separate password for each account and save it in a password manager, so a breach on one site can't be used to access another.
Privacy
All processing happens locally in your browser. Your data is never uploaded.