Generate strong random passwords with cryptographically secure randomness (crypto.getRandomValues, never Math.random), with length, character sets and a strength meter.
Passwords are generated entirely in your browser and are never sent anywhere. Use a password manager rather than reusing passwords.
password strength (entropy)
How to use this tool
16 characters or more is a good default; longer is stronger.
Lowercase, uppercase, digits and symbols — more sets mean a bigger pool and more entropy.
Press Generate password (or change any option) for a fresh, securely random password.
Use the Copy button, and never reuse the same password across sites.
Formula & worked example
A 16-character password drawn from all 89 characters (26 lowercase + 26 uppercase + 10 digits + 27 symbols) has 16 × log₂(89) ≈ 103.7 bits of entropy — very strong.
Limitations — read this before you rely on it
Randomness here comes from crypto.getRandomValues, the browser's cryptographic generator. If a browser cannot provide it, the tool refuses to generate rather than falling back to Math.random, which is not safe for secrets. Generated passwords never leave your device.
Frequently asked questions
Math.random is predictable — its output can be guessed from earlier values. crypto.getRandomValues uses the operating system's secure randomness, which cannot be predicted.
At least 12 characters, ideally 16 or more, drawn from several character sets. Length matters more than clever substitutions.
A measure of how many guesses an attacker would need on average: higher entropy means exponentially harder to crack.
No. They are generated in your browser, shown to you, and never sent to a server.
Yes — use one to store a unique strong password for every site, and turn on two-factor authentication where available.