Strong Password Generator
Generate strong random passwords with crypto.getRandomValues() — your browser's cryptographically secure random source. Passwords are created locally, never transmitted, and never stored.
What makes a password strong
- Length beats complexity. Every extra character multiplies the search space. A 20-character lowercase password is far stronger than an 8-character one packed with symbols.
- Randomness beats cleverness.
P@ssw0rd!follows substitution patterns every cracking tool tries first. It is not meaningfully stronger thanpassword. - Uniqueness beats everything. A strong password reused across sites is only as safe as the least secure site holding it. Credential stuffing after a breach is the most common way accounts are compromised.
- 16+ characters is a sensible minimum for anything that matters; 20 or more for email and banking, since your email can reset everything else.
Use a password manager
Generating strong passwords is only useful if you can also store them, and nobody remembers forty unique 20-character strings. A password manager solves both problems: it generates, stores, and fills them, so you memorise exactly one strong passphrase. This is the single highest-impact security change most people can make. Enable two-factor authentication as well — a compromised password alone is then not enough to get in.
Why this generator is safe to use
A browser-based password generator is only trustworthy if two things are true: the randomness must be cryptographic, and the password must never leave your machine. This tool uses crypto.getRandomValues() rather than Math.random(), which is predictable and unsuitable for secrets. Nothing is sent over the network — there is no request to inspect, and you can verify that in your browser's network tab. Nothing is written to storage either, so closing the tab discards everything.
The look-alike option
Turning on Avoid look-alikes removes 0/O and 1/l/I, which matters when a password will be read aloud, written down, or typed from a printed sheet. It slightly reduces the character pool, so add a couple of characters of length to compensate. For passwords that only ever live in a password manager, leave it off.