Generate strong, random passwords instantly. Everything runs in your browser. Nothing is sent to any server.
A strong password resists both brute-force attacks (trying every combination) and dictionary attacks (trying common words and patterns). Length is the single most important factor: a random 16-character password is exponentially harder to crack than a random 8-character password, even with the same character set. NIST's current guidance (SP 800-63B) emphasizes length over complexity and recommends passwords of at least 15 characters.
Securing network devices? The Subnet Calculator helps plan your IP address allocation and subnetting.
Set your desired password length and select which character types to include: uppercase letters, lowercase letters, numbers, and special characters. The generator creates a cryptographically random password using your browser's built-in random number generator (window.crypto). You can generate multiple passwords, copy to clipboard, and check the estimated strength. The Password Strength Calculator evaluates any password you create.
Use a unique password for every account. Never reuse passwords across sites. Use a password manager (1Password, Bitwarden, or your browser's built-in manager) to store them. Enable two-factor authentication (2FA) on every account that supports it. Consider using a passphrase (4-5 random words) for passwords you need to type manually. Read our full guide on creating strong passwords.
A randomly generated password is fundamentally stronger than a human-created one because humans are predictably poor at generating randomness. Common patterns like starting with a capital letter, ending with a number or exclamation point, and using dictionary word bases make human passwords vulnerable to rule-based attacks. This generator uses cryptographic randomness (Web Crypto API) to produce truly unpredictable strings. For maximum security, generated passwords should be at least 16 characters and include a mix of all character types. Each online account should have a unique password to prevent credential-stuffing attacks (where breached passwords from one site are tried against other sites). A password manager is the practical solution for storing dozens or hundreds of unique random passwords.