Strong Password Generator
Create secure passwords with custom rules and strength check
Your Password
About this tool
Weak and reused passwords are behind most account takeovers. This password generator creates long, random passwords using your browser's built-in cryptographic random number generator, and rates the strength of each one as you adjust the options.
Nothing is sent to a server. The password is created on your device and disappears when you close the page, so copy it straight into your password manager.
How to use it
- Set the length with the slider. Use at least 14 characters for ordinary accounts and 20 or more for important ones.
- Tick the character types you want: uppercase, lowercase, numbers and symbols.
- Tick Exclude ambiguous if you may need to type the password by hand.
- Press Generate for a new password, then Copy it into your password manager.
Why length matters
The number of possible passwords is CL, where C is the size of the character set and L is the length. Using all four character types gives roughly 94 symbols, so every extra character multiplies the search space by about 94. A 16-character password of this kind has about 105 bits of entropy.
Worked example
Comparing two passwords
| Password type | Possibilities |
|---|---|
| 8 lowercase letters | about 2 × 1011 |
| 16 mixed characters | about 4 × 1031 |
The second is roughly 200 quintillion times harder to guess.
Tips and common mistakes
- Use a different password for every account. Reuse lets one breach unlock many accounts.
- Store passwords in a reputable password manager instead of reusing memorable ones.
- Turn on two-factor authentication for email, banking and social accounts.
- Avoid personal details such as names, birthdays and phone numbers, even with substitutions.
Frequently asked questions
Is this password generator safe?
Yes. Passwords are produced in your browser using the Web Crypto API and are never transmitted or stored.
How long should a password be?
At least 14 characters for ordinary accounts and 20 or more for email, banking and password-manager master passwords.
Should I include symbols?
Symbols help, but length helps more. If a site rejects some symbols, add length instead.
What does excluding ambiguous characters do?
It removes lookalikes such as 0, O, l, 1 and I so a password is easier to read or type from a screen.
Can I use the same password on multiple sites?
No. If one site is breached, attackers try the same login elsewhere. Use a unique password for each account.
Why does the password change every time?
Each press generates a fresh random value. Copy the one you want before generating again.