Password Generator

Yes. Randomness comes from your browser’s cryptographic random number generator (the Web Crypto API). Passwords are created on your device and are never stored or sent anywhere.

Entropy measures how unpredictable a password is, in bits. Every extra bit doubles the number of guesses an attacker needs. Around 60 bits or more is generally considered strong for most uses.

Yes. Once the page has loaded, it keeps working without a network connection.

A password needs at least one set of characters to draw from, so the last enabled type stays on.

Length matters more than anything else. 16 or more random characters, the default here, is a strong choice for important accounts; use the slider to go anywhere from 8 to 64 characters. If a site caps the length, use the longest it allows.

With all four types on, each character is drawn from 88 possibilities, about 6.46 bits each, so 16 characters give roughly 103 bits. Letters and numbers only (62 characters) give about 95 bits, and 12 characters with all four types about 78 bits.

From the length and the number of characters to choose from. Strong means at least 80 bits of entropy, or 16+ characters from a set of 60 or more. Good means at least 55 bits, or 12+ characters from 40 or more. Fair means at least 35 bits or 10+ characters, and anything less is Weak.

These 26: ! @ # $ % ^ & * ( ) _ + - = [ ] { } | ; : , . and the less-than, greater-than and question marks. If a site rejects one of them, generate a new password or turn Symbols off and add a few characters of length to make up for it.

Each character is picked independently from all the types you've turned on, so a type can be missing by chance — about 1 in 7 passwords of 16 characters has no digit. That doesn't make it weak, but if a site insists on a number or symbol, just press regenerate.

A passphrase of several random words is easier to type and remember, which suits the few passwords you need to know by heart, such as your password manager or computer login. For everything else, a long random password stored in a password manager is the simpler choice. This tool makes random-character passwords only.

Current guidance, including NIST's, no longer recommends changing passwords on a fixed schedule, because it leads to weaker, predictable passwords. Change one straight away if it may have been exposed in a breach, shared or reused, and turn on two-factor authentication where you can.