Password Generator

Generate cryptographically secure random passwords. Customise length and character types. All processing happens locally in your browser using the Web Crypto API.

20

About Password Security

  • Passwords are generated using the Web Crypto API (crypto.getRandomValues), which is cryptographically secure.
  • Nothing is sent to any server - generation happens entirely in your browser.
  • Use at least 16 characters with a mix of all character types for best security.

Length beats complexity, and it is not close. Every character you add multiplies the work an attacker has to do, while swapping a letter for a symbol adds almost nothing against software that knows the substitution. What actually protects an account is that the password is long, random and used nowhere else, and the only realistic way to manage that is a password manager, because nobody remembers forty distinct random strings.

Related tools

Bcrypt Generator & Checker UUID Generator Hash Generator

How are you actually storing that?

Hashes, tokens and passwords are only as strong as the code around them: a cost factor left at the default, a token nobody checks the expiry on, a secret committed to the repository. We review and harden applications, and we tell you what an attacker reaches first.

Book a security review

Frequently Asked Questions

How long should a password be?
Sixteen characters of random text is comfortable for anything ordinary, and twenty or more for a password manager's own master password or an account that guards others. Below twelve you are relying on the site's rate limiting rather than the password.
Are symbols worth the trouble?
Less than length is. Adding four more characters does more for the strength than sprinkling punctuation through eight, and symbols are what causes a password to be rejected or mangled by a system that handles them badly.
Are these passwords generated safely?
They come from the browser's cryptographic random source, the same one used for keys, rather than from the ordinary random function. Nothing is transmitted, and nothing is stored, so closing the tab is the end of it.
Is a passphrase better than a random string?
For something you have to type from memory, yes: four or five unrelated words are long, strong and possible to remember. For everything a manager fills in for you, a random string is shorter to store and just as strong.
How often should I change them?
Only when you have reason to. Scheduled rotation pushes people towards small predictable edits, which is why the guidance moved away from it. Change a password when a service is breached, when you suspect it is known, or when it was reused.