Random beats clever, every time
Most home-made passwords fail in the same way: they are built from things a person knows — a pet, a football team, a birthday — decorated with a predictable capital letter, a digit, and an exclamation mark at the end. Attackers know this pattern intimately. A password generated by a proper random source has no pattern to learn. Every character is an independent roll of the dice across the whole character pool, so the only way to find it is to try combinations, one after another, until the heat death of the schedule you are protecting against becomes a genuine concern. That is what this generator does: it draws randomness from crypto.getRandomValues, the cryptographic random generator built into your browser, selects characters without statistical bias, and guarantees at least one character from every set you tick.
Entropy: the one number that matters
Password strength is measured in bits of entropy, and the formula is pleasingly simple: length multiplied by the base-2 logarithm of the character pool size. Doubling the pool adds one bit per character; adding one character adds as many bits as the pool provides. This is why length dominates. A 20-character password drawn from letters, digits and symbols has a pool of about 90, giving roughly 130 bits of entropy — a space of combinations so large that guessing it is not a practical project.
Passwords versus passphrases
A random password like the ones this page creates is ideal where a password manager does the remembering — which, in practice, should be almost everywhere. Where you must memorise a secret yourself, such as the master password for that manager or the login for a laptop, a passphrase is the better tool: four or five unrelated common words, chosen randomly rather than as a phrase that means something, give strong entropy in a form human memory can actually hold. What never works is reusing one clever password everywhere with small variations per site. When one site leaks — and the honest assumption is that eventually one will — variations are trivially guessed, and the whole set falls together.
How to use this generator well
Leave the defaults alone for most accounts: 20 characters with all four sets ticked is comfortably beyond brute force. Raise the length towards 32 for anything guarding money, email, or the password manager itself, since email is the reset key to everything else. Tick “avoid ambiguous” when a human will have to read the password aloud or type it from paper — a router label, a shared safe note — because confusing l, I and 1 causes lockouts, not security. If a site rejects symbols or caps the length, adapt the settings rather than weakening your habits globally.
The manager is the real upgrade
A generator solves creation; a password manager solves the rest of the problem. This page is deliberately local-only to match that philosophy: generation uses your device's own secure random source, nothing is sent to a server, nothing is written to storage, and the password vanishes when you close the tab — copy it into your manager before you do.
Frequently asked questions
Is it safe to generate passwords on a website?
On this page, yes, because generation happens entirely in your browser with its cryptographic random source and no network request carries the result. As a habit, prefer generators built into your password manager or operating system, and never type a generated password into a second “checker” site to test it.
How long should my password be?
At least 16–20 characters for ordinary accounts stored in a manager, and longer for email, banking, and the manager's own master password. Length helps more than exotic characters.
Why does this generator avoid predictable characters sometimes?
Only if you tick the ambiguous option. It removes characters that look alike in many fonts — lowercase L, capital i, one, capital O and zero — purely to make manual typing easier. Unticked, the full sets are used.
Should I change my passwords regularly?
Not on a schedule, according to current guidance from security bodies such as NIST. Change a password when there is evidence of compromise, when it was shared, or when it is weak or reused — forced routine changes mainly produce weaker, patterned passwords.
Related tools
- SSL Checker — make sure the site receiving your password encrypts it properly.
- What Is My IP — see the address your logins appear to come from.
- JSON Formatter — tidy the API payloads those credentials protect.
- Subnet Calculator — plan the home network your devices log in from.
- Speed Test — check your connection's ping and throughput.
- DNS Lookup — resolve the hostnames behind your accounts.