RunToolRunPassword Generator
Generate strong and secure passwords.
How to Generate a Strong Password
Set length and character types
Choose the length and toggle uppercase, numbers and symbols.
Generate locally
The password is created with your browser's cryptographic random source.
Copy and store it safely
One click copies it — save it in a password manager, not a text file.
Length beats complexity
The number of possible passwords is the size of the character set raised to the power of the length. Because length is the exponent, adding one character multiplies the search space, while adding a symbol type merely widens the base. A sixteen-character password of lowercase letters has a far larger space than an eight-character password using every symbol on the keyboard.
This is why substitution rules produce weak results. Turning 'password' into 'P@ssw0rd!' satisfies most complexity policies and adds almost nothing, because cracking tools apply exactly those substitutions to dictionary words first. Randomness and length are what matter; decoration is not.
Where randomness comes from
A generated password is only as unpredictable as the source that produced it. Ordinary programming random-number functions are designed to be fast and statistically even, not unguessable — given enough output, their internal state can be reconstructed and every subsequent value predicted.
Cryptographically secure generation is a different mechanism, seeded from operating-system entropy and built so that past output reveals nothing about future output. This is the distinction between a password that is random-looking and one that is actually random, and it is invisible in the result: two strings can look identical in character and differ completely in how hard they are to predict.
Reuse is the failure that actually happens
Most accounts are not lost to brute force. They are lost because a service was breached, the password appeared in a public dump, and the same password was tried against every other account with that email address. A perfect password used in two places offers no protection once either place is compromised.
The practical requirement is therefore a unique password per account, which is more than anyone can remember. A password manager is the only honest solution: one strong passphrase you memorise, everything else generated, stored and never typed by hand. Generating strong passwords without a place to keep them tends to end with them written somewhere worse.
Ambiguous characters and paste-hostile forms
Excluding visually confusable characters — l and 1, O and 0 — costs a negligible amount of entropy and saves real frustration on anything that has to be read aloud, typed on a television remote or transcribed from paper. For a password living permanently in a manager, leave them in.
Some sites still silently truncate long passwords or reject certain symbols, and some block pasting entirely. If a login fails immediately after you set a long generated password, suspect truncation before suspecting a typo, and prefer a longer password made of a simpler character set on systems that are fussy about symbols.
Why generating locally is the point
A password generated on a web server is a password that existed, however briefly, on someone else's machine and possibly in someone else's logs. This generator runs in your browser using the platform's cryptographic random source; the values are created on your device and never transmitted.
That property is only meaningful if the rest of the chain is sound. A strong password does not help an account without two-factor authentication when the attacker has the password, and it does not help if it is reused. Generation is the easy part — the discipline around it is what actually protects the account.