Secure Password Generator
Generate strong passwords in your browser, with an entropy estimate and nothing transmitted.
GeneratorsWhy it must happen in the browser
A password generated on a server and sent over the network has already passed through someone else's hands, and there is no way for you to verify it was not kept. Here generation happens entirely on your own machine: there is nothing to trust, because there is nothing travelling.
Not all randomness is equal
Ordinary random functions in programming languages are predictable: they start from a seed and produce a reproducible sequence. Secrets require cryptographic functions, which draw on entropy collected by the operating system. This tool uses those.
What entropy means
It measures how hard the password is to guess, in bits: each extra bit doubles the attempts required. It depends on just two things — length and how many distinct characters are possible — and length matters far more. A twenty-letter lowercase password is stronger than an eight-character one with symbols and capitals.
Length beats complexity
Complexity rules — at least one symbol, at least one capital — were invented to stop passwords like "password", but they produced the habit of writing "Password1!", which is just as predictable. Lengthening beats complicating, and a long random password does not need to be memorised: it belongs in a password manager.
Frequently asked questions
No. It is created in your browser and never transmitted or stored. Closing the page loses it: copy it first.
For an important account, at least sixteen random characters, which is over ninety bits of entropy. Below fifty bits a password is within reach of an automated attack.
Because a password that is easy to mistype ends up written on a sticky note. If you will have to type or dictate it, dropping l, I, 1, O and 0 is worth it: the small loss of entropy is recovered by adding one character.