Strong Password Generator

How to use 3 steps

Set the Password Length: 16 or more is a good default.
Press Generate Password.
Press Copy Password and save it in a password manager.

Read the full guide

Password Length (8 - 64):

Generated Secure Password

Loading the tool… 0 of 3 parts

Getting the tool ready. On a slow connection this can take a few seconds.

How this tool works

Two things make a password strong: length and unpredictability. Everything else — the substituted characters, the exclamation mark on the end, the capital at the front — is decoration that cracking software has accounted for since the early 2000s.

Characters are drawn from an 88-character set using your browser's cryptographic random number generator, not the ordinary Math.random that many simple generators use. That difference matters: Math.random is predictable once an attacker sees enough output, and was never built for security. Each character carries about 6.5 bits of entropy, putting a 16-character password at roughly 103 bits.

Using what it gives you

Never reuse one: this matters more than length. Stolen credentials get replayed against every other major service, so a perfect password used twice protects nothing once either site is breached.
Take 16 as your floor: a password manager does the typing, so there is little reason to choose a short one.
Regenerate rather than edit: if a site demands a symbol and the draw did not include one, generate again. Editing by hand reintroduces the pattern the randomness removed.
Add two-factor authentication: a strong password defends against guessing. It does nothing against a convincing phishing page or a breach at the service itself.

Full guide

4 min read

How to create a strong password

What actually makes a password hard to guess, why substituted characters do not help, how long is long enough, and where to keep the result.

Read the guide

Frequently Asked Questions

Specific to the Strong Password Generator. Broader questions about this category are answered on the category page.

Are these passwords really random?

They are generated using crypto.getRandomValues, the browser's cryptographically secure random source, rather than the ordinary Math.random function that many simple generators use. That distinction matters: Math.random is predictable if an attacker can observe enough output, and is not intended for security purposes.

Is my generated password sent over the internet?

No. Generation happens entirely in your browser. The password is never transmitted, saved or logged. It exists only in the page until you copy it, and disappears when you close the tab.

Should I change my passwords regularly?

Not on a schedule. Forced periodic expiry was long-standing advice, but it was found to make security worse, because people respond by making small predictable changes to an existing password. Modern guidance from both NIST and the UK's NCSC is to change a password when there is reason to believe it has been exposed, not on a calendar.

Does every generated password contain a symbol and a digit?

Not guaranteed. Each character is drawn independently from the full 88-character set, so a short password may occasionally lack a particular category. If a site demands one of each, generate again — at 16 characters the odds of a missing category are small.

How long would it take to crack a 16-character password?

Longer than is meaningful to state. Any honest answer depends on assumptions about hardware and how the site stored the password, and figures quoted in years are marketing rather than measurement. What is defensible: at roughly 103 bits of entropy, brute force is not the route an attacker would take. They would phish you, or breach the service, instead — which is why unique passwords and two-factor authentication matter more than adding characters.