Password generator
Cryptographically random passwords, built on your device and never uploaded.
This password generator builds a fresh random password every time you press a length button. Each character is drawn from your browser's cryptographic random source, mixing upper and lower case letters, digits and symbols. Pick 12, 16 or 24 characters, copy the result, and paste it straight into a signup form or your password manager.
Runs entirely in your browser. Your text is never uploaded — open DevTools, Network tab, and you will see zero requests while you use this tool.
How to use it
- Press the length you want — 12 characters for most accounts, 16 or 24 for anything you truly care about.
- A random password appears in the box. Press the button again as many times as you like until you get one you are happy to store.
- Press Copy, then paste it into the site and into your password manager at the same time so you never have to type it.
What this tool does
It creates a random string from a pool of 94 printable characters: the 26 lowercase letters, the 26 uppercase letters, the ten digits and 32 common punctuation symbols. Every character in the output is chosen independently, so there is no pattern, no dictionary word and nothing derived from the date, the page or anything about you.
The randomness comes from crypto.getRandomValues, the browser's cryptographically secure random number generator. That is a very different thing from Math.random, which most quick scripts and many web toys use. Math.random is fast but predictable — given enough of its output an attacker can reconstruct its internal state and forecast the rest. getRandomValues is seeded from the operating system's entropy pool and is designed to be unpredictable even to someone who has seen its earlier output.
How strong is strong enough
Password strength is measured in bits of entropy — the base-2 logarithm of how many equally likely passwords the generator could have produced. Every extra bit doubles the number of guesses an attacker must make. With a 94-character alphabet each character adds about 6.55 bits, so length is the lever that matters most:
| Length | Entropy | Roughly means |
|---|---|---|
| 12 characters | ~79 bits | Beyond any offline cracking that is realistic today. Fine for ordinary accounts. |
| 16 characters | ~105 bits | Comfortably future-proof. A sensible default for email, banking and password-manager master passwords. |
| 24 characters | ~157 bits | Overkill for a login, but the right size for encryption keys, recovery secrets and anything you will not rotate. |
For scale: a very well funded attacker who could try a trillion guesses every second would need longer than the age of the universe to exhaust even the 79-bit space. That is why these passwords do not need to be changed on a schedule — length, not rotation, is what protects them. The far bigger risks are reuse across sites and phishing, neither of which password length fixes.
Examples
A 12-character password looks like k7#Rm2$pQ9vL. At 16 characters you get something like Xp4!zR9@mK2wF6nH, and 24 gives you tY8$qW3^rN6&hL0#vB5!zK2m. None of these are real outputs — press a button to make your own — but they show the shape: no words, no keyboard runs, no substituting @ for a. That predictable "leetspeak" is exactly what cracking tools try first, and it is why a random 12-character string beats a clever-looking P@ssw0rd! by an enormous margin.
When you need it
- Any new account. Generate one unique password per site so a breach at one service cannot unlock the others.
- Your password-manager master password — though for one you must memorise, a long random passphrase of real words is easier to remember and just as strong.
- Service accounts, API secrets and database users where a human never types the value and a machine stores it.
- Wi-Fi keys and shared credentials that need to be strong but are pasted, not typed from memory.
- Replacing a password caught in a breach. If a site appears in a leak, rotating to a fresh random value is the fastest fix.
Doing it without this tool
Browser: open the developer console on any page and run crypto.getRandomValues(new Uint32Array(4)), then map the numbers onto your alphabet — the same primitive this page uses, just without the convenience.
Command line: on macOS or Linux, openssl rand -base64 18 gives you a strong 24-character password, or head -c 12 /dev/urandom | base64 for something shorter.
Password managers: Bitwarden, 1Password, KeePass and the generators built into Chrome, Safari and Firefox all create random passwords and — crucially — remember them for you. If you already use one, its generator is the best option because it stores the result in the same step. This tool is for the moments when you are not in your manager, or want a quick strong string with no account and nothing installed.
Privacy: your password never leaves your browser
This is the whole point. Every character is generated by JavaScript running on your own device, and the password is never transmitted, logged or stored anywhere. Open your browser's network panel while you press a button and you will see zero requests go out — once the page has loaded you can switch off your connection entirely and it still works.
That matters because a password is only secret if nobody else ever sees it. A password generated on someone else's server has, by definition, existed on a computer you do not control, where it could be logged, cached in a crash report, or captured by whoever runs the site. Local generation removes that risk completely — the password is created, shown to you, and forgotten by the page the moment you navigate away.
Related tools
Frequently asked questions
Yes, when it comes from crypto.getRandomValues as this one does. That is the same cryptographic random source browsers use for TLS and other security features. The weak link is almost never the randomness — it is reuse, phishing or storing the password somewhere insecure.
Twelve random characters is enough for ordinary accounts and already beyond realistic cracking. Use 16 for email, banking and your password-manager master password, and 24 for encryption keys or secrets you will never rotate. Length adds far more strength than adding exotic symbols.
No — forced periodic changes are outdated advice that NIST and other security bodies dropped years ago, because they push people toward weak, guessable patterns. Change a password only when it may have leaked, when a service reports a breach, or if you ever reused it somewhere else.
Yes, and this is the single most important habit. Reusing one password means a breach at any site — including small ones with poor security — hands attackers the keys to your email and bank. A unique random password per site contains the damage to that one account.
You do not — you store them. Use a password manager so the only thing you memorise is one strong master password. For that single memorised secret, a passphrase of four or five random words is easier to recall and just as strong as a random string.
Almost always, but a few sites still reject certain punctuation or cap password length. If one refuses your password, generate a new one, or fall back to a longer letters-and-digits password, since extra length recovers any strength lost by dropping symbols.
No. The generation happens entirely in JavaScript on your device and nothing is sent anywhere — you can verify this by watching the network panel or by disconnecting from the internet, after which the tool still works. Nothing is uploaded, logged or stored.