This generator builds passwords from a cryptographically secure random source and mixes in at least one character from every class you select. Length matters more than symbols: a long password from a large alphabet is harder to guess than a short password with every punctuation mark in it.
Generate a password
How strong is strong enough?
The estimate below is the entropy of the password, measured in bits: length multiplied by the base-2 logarithm of the alphabet size. Each extra bit doubles the work for an attacker who has to search every possibility. Around 50 bits stops a casual guesser, 75 bits is reasonable for most online accounts, and 100 bits or more is comfortable for password managers, disk encryption and API keys.
Entropy describes the generation process, not the resulting string. A password that looks random but was generated by a predictable source, or reused from another site, has no useful entropy at all. The safest pattern is a unique generated password per account, stored in a password manager.
What to do with the password
- Store it in a password manager rather than memorising or reusing it.
- Keep the default length of 20 or raise it; every added character multiplies the search space.
- Turn on symbols only when the site accepts them. Some legacy systems reject punctuation, and a long alphanumeric password is still strong.
- Turn on the ambiguous-character filter when the password will be typed by hand or read aloud.
- Change any password immediately if it appears in a breach notification, even if it looks strong.
Generation uses crypto.getRandomValues with rejection sampling to avoid modulo bias. The password is created in this tab and is never sent anywhere.