Password Generator
Generate a strong, random password with adjustable length and character types.
Set a password length and choose which character types to include — uppercase, lowercase, numbers, and symbols — then generate a cryptographically random password using the browser's crypto.getRandomValues function, which is designed for security-sensitive randomness rather than predictable pseudo-random numbers. The password is generated locally and never transmitted anywhere.
Why 'random-looking' isn't the same as actually random
Math.random(), the default random number function in JavaScript, is a pseudo-random generator designed for things like games and animations, not security — its internal state can theoretically be predicted or reconstructed under some conditions. crypto.getRandomValues, which this tool uses instead, pulls from your operating system's cryptographically secure random number source, the same underlying randomness used for generating encryption keys, which is specifically designed to be unpredictable even to someone who understands exactly how the generator works.
What actually makes a password hard to guess
Password strength against automated guessing comes down mostly to entropy — how many possible combinations an attacker would have to try. Length contributes more to this than character variety once you already have a reasonable mix: a 20-character password using only lowercase letters is harder to brute-force than an 8-character password using every character type available, simply because the total number of possible combinations grows so much faster with each added character.
Why sites still enforce specific character-type rules
Many password policies require at least one uppercase letter, one number, and one symbol, partly to guard against very simple, easily-guessed choices, and partly as a legacy holdover from older security guidance that has since been somewhat revised by organisations like NIST, which now emphasise length over complex character rules. This tool lets you satisfy those legacy rules by toggling character types on, while still defaulting to a length that gives strong protection either way.
How to use it
- Set your desired password length using the slider.
- Check the character types you want included.
- Click Generate.
- Click Copy to copy the password to your clipboard.
Common ways people use this tool
Creating a new account password
Generate a strong, unique password when signing up for a new online service rather than reusing an old one.
Setting a Wi-Fi network password
Create a long, random password for a home router that's hard to guess but can be written down once and shared as needed.
Generating a temporary password for a shared account
Create a one-off strong password to hand off to a colleague or family member for a shared login.
Tips for getting the best results
- Aim for at least 16 characters where a service allows it — length matters more than people expect for resisting brute-force attempts.
- Use a password manager to actually store generated passwords, rather than trying to memorise long random strings.
- Generate a fresh, unique password for every account rather than reusing one password anywhere — a breach on one site then can't compromise others.
- If a site has strict complexity rules, keep all four character types checked to avoid a rejected password on submission.
Frequently asked questions
Is this password generator secure?
Yes — it uses the Web Crypto API's crypto.getRandomValues, which produces cryptographically strong randomness suitable for passwords, unlike Math.random().
What's a good password length?
Most current security guidance recommends at least 12–16 characters with a mix of character types for accounts that support it.
Does the tool store generated passwords anywhere?
No — nothing is saved or logged. Once you navigate away, the password only exists wherever you've copied it.
Can I exclude ambiguous characters like 0 and O?
Not in this version, but keeping a longer length with all character types enabled reduces the practical impact of any ambiguous-looking characters.
Why does the tool recommend using a password manager?
Long, random, unique passwords are secure precisely because they're hard to remember — a password manager stores them securely so you don't have to memorise dozens of complex strings yourself.
Is a longer password always better than a more complex one?
Generally yes for resisting brute-force guessing, since each additional character multiplies the number of possible combinations far more than adding one more character type does.
Should I change my passwords regularly even if there's no known breach?
Current security guidance has moved away from mandatory periodic changes without cause, favouring instead unique, strong passwords per account plus prompt changes only if a specific breach is suspected or confirmed.
Can I generate a password that's easier to type but still secure?
Unchecking symbols while keeping a longer length (like 20+ characters of letters and numbers) trades a small amount of theoretical strength for easier typing, while still remaining far stronger than a short, memorable password with all character types.
Does using this tool mean my new password is instantly known to anyone else?
No — the password is generated entirely within your own browser session and isn't transmitted, logged, or visible to anyone else unless you choose to share it yourself.
What should I do if a website rejects the generated password for being 'too long'?
Simply lower the length slider to fit within that site's specific maximum, ideally still keeping it as long as the site allows, since some services impose unusually short maximum password lengths.