People are not good at inventing passwords. We think we are being clever, and so do the thousands of others who reach for the same trick at the same moment: a pet's name with a number on the end, a capital letter at the start, an exclamation mark to finish. Cracking tools try those habits first because they work. A generator has no habits, and that is the whole case for using one.
Why let a generator do it
Every password on this page is built inside your browser tab, using the same secure random source the browser uses for its own security features. Each character is chosen independently, so there is no pattern for anyone to learn from your last password or guess about your next one. Close the tab and it is gone. Nothing gets saved on our side, because nothing ever reaches us.
Length first, then variety
If you only change one thing, make the password longer. Each extra random character multiplies the number of possibilities an attacker has to work through, so going from ten characters to fourteen is a far bigger jump than it looks on the slider. The character types (uppercase, lowercase, numbers, symbols) add to that, but a long password from a smaller set will usually beat a short one crammed with symbols.
The default here is 16 characters with all four types switched on, and the slider runs from 8 to 64. That default is a sensible place to start for almost any account. If a site refuses symbols, untick them and add a few characters instead. There is a longer explanation in the strong password guide, and if a site asks for exactly 12 or 15 characters the 12 and 15 character generator is set up for that.
The other tools on this page
The page holds four small tools, and each one suits a different moment.
- Password. For anything you will paste from a password manager. Length, four character types, one click.
- Passphrase. Three to eight random words with an optional capital letter, number and separator. It is easier to type by hand, which is why people use it for a master password. The dedicated passphrase generator goes into more detail.
- Strength check. Paste a password you already use and get an estimate of how hard it would be to crack, with warnings for things like repeated characters or a run such as 1234.
- PIN. Four to eight digits for locks and keypads. If you use these a lot, the numeric PIN generator has its own guide.
Where the password should live
A random 16 character password is not something you will remember, and you should not try. Put it in a password manager and let the manager fill it in. That also solves the bigger problem, which is reuse. One good password used on twenty sites is still one breach away from twenty problems. A different generated password for each account means a leak at one company stays at that company.
The manager itself needs one secret you can type from memory. That is the job for a passphrase, not a random string.
Your browser or phone probably already offers one
Chrome, Safari, and Edge all suggest a random password the moment you sign up for something new, and iOS and Android do the same through their built-in keychains. Those are perfectly good generators, and if you're already deep into one ecosystem and happy with how it saves and fills passwords, there's no real need to switch. This page is for the moments that fall outside that flow: setting a WiFi password that isn't tied to any account, generating something on a work computer where you can't install a password manager, checking the strength of an old password a built-in tool won't evaluate for you, or just wanting a password with options you can see and adjust on the spot rather than accepting whatever a browser hands you.
Match the tool to the job
Some accounts deserve extra thought because of what they unlock:
- Your email account is the reset route for almost everything else, so treat it as the most important password you own.
- A Facebook or social media account gets hijacked to scam your friends, and reuse plus phishing is how it usually happens.
- Your router needs a network key, and the WiFi password generator also shows where to enter it on common brands. Once it is set, a WiFi QR code lets guests join without you reading it out.
- Developers who need tokens, keys or test data will want the random string generator, which is built for machines rather than people.
Checking a password you already have
Most people have at least a few old passwords they are quietly worried about. Paste one into the strength check and read what comes back. The estimate is a guide, not a verdict, and it works best as a nudge. If it flags something, replace that password rather than tweaking it. Adding a digit to a weak base changes very little.
Is it actually safe to generate a password on a website?
It's a fair question, and one worth asking of any site that offers to hand you a password. The honest answer is that it depends entirely on where the generation happens, not on who's offering it. If a site sends your request to a server and the server sends back a password, that server technically saw it, however briefly, and however good the site's intentions. This page doesn't work that way. Every character is generated by JavaScript running inside your own browser tab, using the Web Crypto API your operating system already provides. There's no server-side step at any point where a password gets created. You can verify this without trusting a single word here: open your browser's developer console, type typeof crypto.getRandomValues, and you'll see it's a native browser function, not something this site invented. Then watch the Network tab while you generate a password and see that nothing gets sent anywhere.
Nothing leaves your tab
You do not have to take our word for it. Open your browser's developer tools, switch to the Network tab, and click Generate a few times. Generating a password makes no network request. The page does load fonts and styling from other servers when it first opens, which is described in our Privacy Policy, but none of that carries what you generate or type.
Pick a length, generate, copy it into your manager, and move on. That is all a good password needs from you.