Password Generator
Cryptographically random passwords with adjustable length and character sets. All entropy from your browser.
What is a Secure Password Generator?
A secure password generator creates random passwords using cryptographically secure randomness (via the browser's crypto.getRandomValues API) so that the generated passwords are unpredictable and resistant to brute-force attacks. You can customise the length and character set to meet the requirements of any website or application.
This tool generates passwords locally in your browser — nothing is ever transmitted or stored.
How to generate a secure password online
- Set the desired length (12+ characters recommended; 20+ for high-security accounts).
- Choose the character sets to include: uppercase, lowercase, numbers, and symbols.
- Click Generate to create a new password.
- Click Copy to copy it to your clipboard and paste it into your password manager.
Frequently Asked Questions
How long should my password be?
Security experts recommend a minimum of 12 characters for standard accounts and 16-20+ characters for financial or email accounts. Each additional character exponentially increases the time required to crack the password by brute force.
Is this password generator truly random?
Yes. This tool uses window.crypto.getRandomValues, which provides cryptographically secure random numbers sourced from the operating system's entropy pool — the same source used by security-critical software.
Should I store generated passwords in a password manager?
Absolutely. A password manager (Bitwarden, 1Password, KeePass) lets you use a different strong random password for every account without memorising any of them.
What makes a password weak?
Short length, common words, predictable patterns, reuse across multiple sites, and keyboard walks (qwerty, 123456) are the most common weaknesses. A random 16-character password with mixed character sets avoids all of these.
Do you store the passwords I generate?
No. Passwords are generated entirely in your browser. Nothing is sent to any server, and no passwords are stored or logged anywhere.