Strong passwords, generated on your device
Weak and reused passwords are behind most account takeovers. This generator builds genuinely random passwords with your choice of length (up to 64 characters) and character sets, and rates the result with a live strength meter based on its entropy. Because generation happens in your browser with the Web Crypto API, the password exists only on your screen.
Prefer words? Use a memorable passphrase
Switch the mode above to Memorable passphrase and the generator builds your password from random everyday words instead of characters: choose three to six words, a separator such as a hyphen or space, optional capitalisation, and an optional trailing number. A passphrase like that is far easier to remember and to type on a TV or phone keyboard than a string of symbols, and because every word is drawn at random from a list of over a thousand, it stays properly strong. Five or six words is the sweet spot for a master password you will type often. This style of password is sometimes called a diceware passphrase, after the dice based word lists that popularised it.
How to use generated passwords well
- Use a unique password for every account, especially email and banking.
- Store passwords in a password manager rather than a notes app or browser autofill alone.
- Turn on two-factor authentication wherever it is offered; it protects you even if a password leaks.
- Prefer length: a 20 character password with symbols is stronger than a short, clever one.
How the generator works under the hood
Ordinary random functions in code are built for speed and games, and their output can be predicted if someone learns the starting state. This tool instead asks the browser for cryptographic randomness, the same source used to set up secure connections. Each character is picked by drawing a random number, and the picker uses a technique called rejection sampling so that every character in the pool is exactly equally likely, with no subtle bias toward the start of the alphabet. The generator also makes sure at least one character from every set you switched on appears, then shuffles the whole password so those guaranteed characters do not sit in predictable positions. The strength meter converts the result into bits of entropy, a direct measure of how many guesses an attacker would need. Doubling the password length adds far more entropy than adding one more exotic symbol, which is why the meter rewards length so strongly.
Practical tips for real accounts
- Protect the email account first: whoever controls your email can reset almost every other password. Give it your longest password and two factor authentication.
- Match settings to the site: some older sites cap passwords at 12 characters or ban certain symbols. Generate at the site limit, keep every allowed set on, and length will do the heavy lifting.
- Generate, then save immediately: copy the password straight into your password manager and the signup form in the same sitting. A brilliant password that you lose locks you out just as surely as a weak one invites others in.
- Use passphrases where you must type: for a device you unlock by hand many times a day, a word based passphrase you practiced a few times beats a short password you keep resetting.
- Rotate after a breach notice: if a service reports leaked data, generate a fresh password for that account and check you never reused the old one elsewhere.
A worked example
Imagine you generate a password with all four character sets switched on. At 12 characters the meter shows roughly 72 bits of entropy, already far beyond what online guessing can reach, because a website will lock or slow attempts long before an attacker makes progress. Stretch the slider to 20 characters and entropy rises to about 120 bits. A cracking rig testing a leaked password database at billions of guesses per second would need longer than the age of the universe to work through that space. In practice that means length is your cheapest security: going from 12 to 20 characters costs you nothing, because the password manager does the remembering, and it multiplies the difficulty for an attacker enormously.
Common mistakes to avoid
- Editing the result to make it memorable: swapping a character for your pet name or birth year reintroduces the patterns attackers try first.
- Reusing one strong password everywhere: strength does not help when a single leaked database hands the same key to every account you own.
- Saving passwords in plain notes or screenshots: anyone or any app with access to those files has all your accounts. Use a proper password manager with its own master password.
- Sharing passwords by email or chat: messages sit in archives and backups. If you must share access, use the sharing feature built into your password manager.
- Ignoring recovery options: a strong password plus outdated recovery email or phone number is a lockout waiting to happen. Review recovery settings when you set a new password.