About Secure Password Generator
Password Generator creates strong, truly random passwords for your accounts. You choose the length and character types, see an estimate of how long the password would resist an attack, and copy it with one click.
How it works
Passwords are built with crypto.getRandomValues, your browser's cryptographically secure random number generator. It's the same source of randomness used for encryption keys. Ordinary Math.random() is predictable and shouldn't be used for passwords. The tool also uses rejection sampling, so every character in the pool is exactly equally likely, with no subtle bias toward some letters.
When "at least one of each type" is on, one character from each selected set is placed first, the rest are filled from the full pool, and everything is shuffled so those guaranteed characters don't sit in predictable positions.
What makes a password strong?
Strength is measured in bits of entropy: length × log₂(pool size). Each extra bit doubles the number of guesses an attacker needs. The strength meter assumes an offline attack at 10 billion guesses per second.
- Under 40 bits: weak, crackable in minutes to hours.
- 60–80 bits: strong for most online accounts.
- Over 80 bits: very strong. A 16-character password using all four types reaches about 104 bits.
Length beats complexity. Adding characters raises the strength much faster than adding symbol types.
Password best practices
- Use a different password for every account. Reused passwords are how one data breach becomes many.
- Store them in a password manager such as Bitwarden, 1Password or your browser's built-in manager.
- Use at least 16 characters for email, banking and other important accounts.
- Turn on two-factor authentication (2FA) wherever it's offered.
- Exclude look-alike characters (I, l, 1, O, 0) when a password will be read aloud or typed from paper, like a Wi-Fi password.