Password generator

Made on your device. Never sent or stored.

Strong, random passwords made on your device. Pick a length, choose the characters, copy. Nothing leaves your browser.

How this generator works

Each character is chosen with crypto.getRandomValues, the cryptographically secure random number generator built into your browser. It draws from the same operating system source used for encryption keys, so the output cannot be predicted from earlier output.

A common mistake in password generators is taking a random number modulo the size of the character pool. That makes the first few characters slightly more likely than the rest. This generator uses rejection sampling instead: a random value that would introduce that bias is thrown away and drawn again, so every character in the pool has exactly the same chance.

When "at least one of each type" is on, one character from each chosen type is placed first, the rest are filled from the whole pool, and the result is shuffled with the same secure generator. That satisfies sites with composition rules and costs a fraction of a bit of entropy.

What the strength figure means

Entropy, in bits, measures how many guesses a password could take. A password of length L drawn at random from a pool of N characters has L times log2(N) bits. Every extra bit doubles the work. Because this site generates the password itself, it knows the exact pool and length, so the figure is exact rather than a guess.

The time shown assumes the worst common case: a stolen database of fast, unsalted hashes attacked offline at 10 billion guesses a second on graphics cards. Against a site that stores passwords with a slow hash such as bcrypt or Argon2, or that limits login attempts, the same password lasts far longer.

How long should a password be?

Length matters more than anything else. NIST SP 800-63B-4, the United States federal guideline published on 31 July 2025, requires at least 15 characters when a password is the only factor, and at least 8 when it is combined with another factor. It also tells sites to stop forcing mixtures of character types and to stop forcing periodic changes. This site defaults to 16.

Length	Letters and digits	With symbols
8 characters	3 hours 48 bits	2 days 52 bits
10 characters	1 year 60 bits	39 years 64 bits
12 characters	5,112 years 71 bits	297,918 years 77 bits
14 characters	20 million years 83 bits	2 billion years 90 bits
15 characters	1 billion years 89 bits	196 billion years 97 bits
16 characters	76 billion years 95 bits	17 trillion years 103 bits
20 characters	1 quintillion years 119 bits	978 quintillion years 129 bits
24 characters	over 10²⁵ years 143 bits	over 10²⁸ years 155 bits
32 characters	over 10³⁹ years 191 bits	over 10⁴⁴ years 206 bits

Average time for an offline attack on a stolen database of fast, unsalted hashes at 10 billion guesses per second (half the search space).

Read how long a password should be for the reasoning, or the full summary of the 2025 NIST password rules.

Tools on this site

Passphrase generatorRandom words you can remember and type. Strength checkerTest a password and check it against known breaches. PIN generatorRandom PINs that skip the guessable ones. Random strings and API keysHex, Base58 and URL-safe tokens. Wi-Fi password generatorWPA2 and WPA3 keys that are easy to read out. No special charactersFor sites that reject symbols.

Questions

Is it safe to generate a password on a website?

It is safe when the password is made on your device and never sent anywhere, which is how this site works. You can confirm it: open your browser developer tools, watch the Network tab while you generate, and you will see no requests. You can also load the page, disconnect from the internet, and it keeps working.

Do you store or log the passwords?

No. There is no account, no database and no analytics script. Your chosen settings, such as length, are remembered in your own browser storage so the page opens the way you left it. The passwords themselves are never stored.

Are symbols required for a strong password?

No. Length adds more strength than symbols do. A 16 character password of letters and digits has about 95 bits of entropy; adding symbols raises that to about 103. NIST no longer recommends forcing symbols. Use them when a site requires them, or when the length is capped.

Should I change my passwords regularly?

Not on a schedule. NIST SP 800-63B-4 says sites shall not require periodic changes, because forced changes push people toward predictable patterns. Change a password when there is a sign it was exposed, such as a breach notice.

How do I remember a random password?

You do not need to. Store it in a password manager and remember one strong passphrase to unlock the manager.

Sources

NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (final, 31 July 2025), National Institute of Standards and Technology. Checked 18 October 2026.
SP 800-63B-4, section 3.1.1.2: Password Verifiers, National Institute of Standards and Technology. Checked 18 October 2026.
Crypto: getRandomValues() method, MDN Web Docs. Checked 18 October 2026.

Related tools and guides

Passphrase generatorRandom words you can remember and type.Strength checkerTest a password and check it against known breaches.NIST password rules (2025)What SP 800-63B-4 changed and what it means for you.16 charactersAbout 103 bits with every character type.