Generate a Strong, Random Password
Generate a strong, random password with the length and character types you choose, locally and safely.
The password never leaves your device
Nothing is stored between visits
Platform-grade randomness
Verifiable in your browser
How it works
- 1
Choose a type
A random string for a password manager, or a passphrase for something you must type by hand.
- 2
Set the length
Longer is the single most effective change you can make; the character set matters far less.
- 3
Copy it into your manager
Store it before you close the tab — this page keeps no history, deliberately.
Why use this tool
Cryptographic randomness
Values come from the browser’s secure generator, not a general-purpose one an attacker could reproduce.
Length you control
Length contributes more strength than any symbol rule, and the slider goes far past the usual minimums.
Passphrase mode
Several random words, which is easier to type on a phone and easier to remember than a symbol soup.
Ambiguous characters optional
Exclude `l`, `1`, `O`, and `0` when the password will be read aloud or typed from paper.
Never transmitted
The password is produced in your browser and no request is made, so nothing else ever sees it.
Free, no account
No signup, no watermark, no cap on how many you generate.
Strength comes from how it was chosen, not how it looks
The measure that matters is entropy: how many equally likely possibilities an attacker would have to work through, which depends on the size of the alphabet and the length, and — crucially — on the choice being genuinely random. This is why appearance is such a poor guide. `P@ssw0rd!` satisfies every complexity rule ever written and appears in every cracking dictionary, because the substitutions are the ones everybody makes. Meanwhile a sixteen-character string of nothing but lowercase letters, chosen at random, is far beyond reach. Cracking tools do not try combinations alphabetically; they try leaked passwords first, then dictionary words, then dictionary words with predictable substitutions and a digit on the end. A password only resists that if nothing about it was a human decision.
The composition rules you were taught are now advised against
For two decades the standard advice was a symbol, a digit, mixed case, and a change every ninety days. The current guidance from NIST — the American standards body whose earlier recommendations put those rules everywhere — explicitly reverses both. Mandatory composition rules were dropped because they do not produce randomness; they produce a predictable shape, since almost everyone puts the capital first and the digit and exclamation mark last, which shrinks the search space rather than expanding it. Forced periodic rotation was dropped for the same reason: people asked to change a password every quarter increment a number, and `Spring2024!` becomes `Summer2024!`. What replaced both is length, a check against known breached passwords, and changing a password when there is a reason to believe it is exposed rather than on a calendar.
Why a passphrase is a reasonable answer, with one condition
Not every password lives in a manager. A device login, a disk encryption key, or the master password protecting everything else has to be typed by a human, sometimes on a phone keyboard, sometimes from memory under mild stress. For those, several random words beat a shorter symbol string on both counts: a sequence of five or six words drawn from a large list carries plenty of entropy while remaining memorable and typeable. The condition is that the words must be chosen by the generator, not by you. Human-chosen words cluster heavily around concrete nouns, and a phrase you invented follows grammar and association in ways that dramatically narrow the possibilities. Random words look arbitrary because they are, and that arbitrariness is the entire strength.
A generator is only as good as its randomness
Everything above assumes the source is unpredictable, and that assumption is not free. A generator built on a general-purpose random function — the kind used for shuffling a list or picking a colour — is fast and seeded from something guessable, often the current time. An attacker who knows roughly when a password was generated can regenerate the candidates and search a space of thousands instead of quintillions. This has produced real, documented compromises in wallets and key-generation tools. A password generator must draw from the platform’s cryptographic source, which is what this page uses. The corollary matters just as much: a generator that runs on a server produces the value somewhere you cannot see, and you have no way to know what happened to it afterwards.
Brute force is not the attack you should be planning for
It is worth naming the real threat, because optimising the wrong thing is common. Almost nobody loses an account to a password being guessed character by character. They lose it because the same password was used somewhere else and that other service was breached, and the attacker simply tried the leaked combination everywhere — credential stuffing, which needs no cracking at all. Or they lose it to a convincing login page that captured it directly, where strength is irrelevant because the password was handed over. The defences that actually address these are a different password for every service, which requires a manager because nobody remembers hundreds, and a second factor, which makes a stolen password insufficient on its own. A strong generated password is necessary and is not, by itself, the protection.
Why a generated password must never cross a network
This tool creates the value in your browser and makes no request, and for this particular task that is not a nicety but the whole requirement. A password generated on someone else’s server was known to that server at the moment of creation. Even with the best intentions it may sit in a request log, a load balancer’s buffer, or an error report, and none of that requires anyone to act maliciously. Once a secret has been transmitted, you cannot prove it was not retained, and a password you cannot vouch for is not a secret. You can confirm the behaviour here in the Network tab of your developer tools: generate a password with the panel open and watch that nothing leaves. That is the only version of this tool worth using.
Common mistakes to avoid
- Trusting a password because it looks complex. `P@ssw0rd!` satisfies every composition rule and sits in every cracking dictionary — strength comes from random choice, not from substitutions everyone makes.
- Adding symbols instead of length. Length contributes far more entropy than any character-class rule, and a longer all-lowercase string beats a short “complex” one.
- Choosing the words in a passphrase yourself. Human-chosen words cluster around concrete nouns and follow grammar, which collapses the search space; the generator must pick them.
- Using a generator built on a general-purpose random function. If it is seeded from the clock, an attacker who knows roughly when you generated can reproduce the candidates.
- Reusing a strong password across services. Credential stuffing needs no cracking at all — one breach elsewhere is enough, so uniqueness plus a manager matters more than raw strength.
How it compares
| Aspect | This tool | Online generators | A password manager |
|---|---|---|---|
| Value crosses a network | Never | Often | No |
| Cryptographic randomness | Yes | Usually unstated | Yes |
| Passphrase mode | Yes | Sometimes | Usually |
| Entropy shown in bits | Yes | Rarely | Sometimes |
| Stores the result for you | No — by design | No | Yes |
| Price | Free | Free / paid tiers | Free / paid |
Features
Random strings and passphrases
Two modes, because a vault entry and a device unlock code have different requirements.
Uses the platform CSPRNG
The browser’s cryptographic generator, which is the same source your operating system uses for keys.
Character set control
Uppercase, lowercase, digits, and symbols, each switchable for systems with awkward restrictions.
Live strength estimate
Shown as entropy in bits rather than a vague “strong” badge that means nothing.
Bulk generation
A batch at once when you are provisioning several accounts or seeding a test environment.
No history kept
Nothing is stored between visits, so a shared computer does not leak your last generation.
Nothing to install
No extension, no runtime, no dependencies — it runs on the web page.
Arabic and RTL ready
Full interface in eight languages, including right-to-left Arabic.
Secure by default
Served over HTTPS, with no tracking and no third-party requests.
Who uses it
Everyone with more than one account
Producing a unique password per service, which matters more than any single password’s strength.
System administrators
Provisioning credentials for several accounts without a value ever crossing the network.
Developers
Generating a strong secret for a configuration file or a test environment.
Anyone setting a master password
Producing a passphrase that is memorable to type and still genuinely random.
Frequently Asked Questions
No. Every password is generated locally in your browser using the Web Crypto API — nothing is ever sent, logged, or stored.
Yes. They use crypto.getRandomValues — a cryptographically secure random source — not the predictable Math.random. For strong security, use at least 16 characters and enable multiple character types.
No. Everything runs locally in your browser — your text is never uploaded, stored, or shared.
Yes — completely free, with no account and no limits.