How long should a password be?

Most current guidance recommends at least 12 to 16 characters for important accounts. Longer passwords are generally better where a site allows it, since length increases brute-force resistance more than adding symbols does.

Why exclude ambiguous characters from a password?

Characters like 0/O or 1/l/I can look identical in some fonts. Excluding them avoids typos when a password must be typed by hand, at a small cost to the character pool size.

Should a password be reused across sites?

No. If one site is breached, reused passwords let attackers try the same credentials elsewhere, a technique called credential stuffing. A unique password should be generated for every account.

Strong Random Password Generator — Free & Secure

Q: Is it safe to generate a password on a website?

This tool generates the password entirely in the browser using the Web Crypto API, and it is never sent to a server. It is still good practice to only use password generators from trusted sites.

Generate a password

How this works

Passwords are generated entirely in your browser using the Web Crypto API's crypto.getRandomValues() — the same cryptographically secure random number source browsers use for things like generating encryption keys. That's a meaningfully different (and stronger) guarantee than Math.random(), which is not designed to be unpredictable and shouldn't be used for anything security-related. Nothing you generate here is transmitted anywhere.

What makes a password strong

Length matters more than complexity: a 16-character password using only lowercase letters is typically harder to brute-force than an 8-character password mixing every character type. The strength estimate above is based on entropy (roughly, how many attempts a brute-force search would need), calculated from length and how many possible characters each position could be — it's a reasonable guide but not a guarantee against every kind of attack (a random 8-character password is still weak, no matter how "strong" the bar says relative to other 8-character options).

A password manager beats memorizing

The best practice is a unique, random password for every account, stored in a password manager, so you never have to remember or reuse one. Generate one here, save it directly into your password manager, and you never need to type or recall it again.

Frequently asked questions

Is it safe to generate a password on a website?

This one is: the password is generated entirely in your browser using the Web Crypto API and is never sent to any server. That said, it's good practice to only use password generators from sites you trust, since a malicious one could log what it generates.

How long should my password be?

Most current guidance recommends at least 12-16 characters for important accounts. Longer is better when a site allows it, since length increases brute-force resistance more than adding symbols does.

Why exclude ambiguous characters?

Characters like 0/O or 1/l/I can look identical in some fonts. If you'll ever need to type the password by hand (reading it off a phone screen, for example) excluding them avoids typos — it slightly reduces the character pool, so skip it for passwords stored only in a password manager.

Should I reuse a password across sites?

No — if one site is breached, reused passwords let attackers try the same credentials everywhere else ("credential stuffing"). Generate a new, unique password for every account instead.