Free Password Generator
What makes a password strong is mostly length and randomness
Most people think a strong password is a clever one, full of substitutions and a symbol at the end. In reality the two things that matter are length and genuine randomness. A long password chosen by a random process is very hard to guess, and a short one that you invented is not, no matter how many exclamation marks it contains, because human choices follow predictable patterns that attackers know and try first. This generator removes the human from the picture: it asks your browser’s secure random number generator for every character.
How to generate one
- Set the length. Sixteen characters is the default and a good minimum for accounts that matter.
- Choose which character types to include: uppercase, lowercase, numbers and symbols.
- Tick Skip look-alike characters if you might need to read or type the password, so that I, l, 1, O and 0 are left out.
- Choose how many passwords you want.
- Click Generate, and copy one straight into your password manager.
What entropy means, without the maths
Each password shows a strength estimate in bits of entropy. Think of it as the number of times an attacker would have to double their guessing effort. Every extra bit doubles the work, so a password with 20 more bits is a million times harder to crack. As a rough guide, anything over about 80 bits is very strong for ordinary accounts, and the default sixteen random characters from all four sets comes out well above 100. These figures only hold for truly random passwords like the ones made here, not for ones you thought up yourself.
Use a manager, and stop remembering passwords
The best way to use a generator is with a password manager. The manager stores a different long random password for every account and fills it in for you, so the only thing you need to remember is one strong password for the manager itself. That one is worth making a long passphrase of several unrelated words you can recall. Trying to remember dozens of random passwords is neither realistic nor necessary.
Habits that matter more than the perfect password
- Never reuse passwords. When one site is breached, reused passwords open your other accounts.
- Turn on two-factor authentication for email, banking, cloud storage and social accounts. Your email is the master key to the rest.
- Keep recovery codes somewhere safe, offline.
- Be wary of phishing. A perfect password does nothing if you type it into a fake page, so check the address first.
- Change a password promptly if a service tells you it was breached.
When a site has strange rules
Some sites set a maximum length, forbid certain symbols or insist on specific character types. If a generated password is rejected, reduce the length a little, untick Symbols, or tick them on and try again. When a site limits you to a short password, use the most random one you can within the limit, and rely on two-factor authentication for the rest of the protection. It is also a sign that the site may not treat security very seriously.
Passphrases: the memorable alternative
For the one password you must remember, such as your password manager’s, a passphrase of four or five random, unrelated words is both strong and memorable. The words must be genuinely random, not a quote or a line from a song, and a few extra characters help. Use the generator for everything else, and keep the passphrase only for the manager and your device.
How this generator works
It calls the secure random function built into modern browsers, picks each character evenly from the set you allowed, and shows the result. Nothing is generated on a server, logged or stored, and the passwords disappear when you close the tab. Because they exist only on your screen, copy the one you want into your manager before you leave.
FAQ
This one creates passwords in your browser with a secure random source and never sends them anywhere. Copy the password straight into your password manager.
At least 16 characters for important accounts. Longer is always stronger.
Yes when the site allows them, as they add strength. If a site rejects some symbols, add length instead.
It leaves out characters that are easy to confuse, such as I, l, 1, O and 0, which helps if you ever need to read or type the password.
No. They exist only in your browser tab.
For the one password you must remember, such as your password manager, a long passphrase of random words is a good choice. Use generated passwords for everything else.