Password Generator

How to build a password that actually holds up

Most of us learned the wrong lesson about passwords. We were told to swap an "a" for an "@", tack on an exclamation mark, and capitalize the first letter, then call it secure. The trouble is, attackers learned those tricks too. A password like "P@ssw0rd!" looks complicated to a human and trivial to a cracking program. What really protects an account isn't cleverness. It's length, randomness, and the simple discipline of never using the same password twice.

This page generates passwords right in your browser. You pick the length and which character types to include, and the tool builds a fresh random string on the spot. Nothing you generate is sent anywhere, logged, or stored. Below, here's the reasoning behind why the defaults are set the way they are, and how to get the most out of them.

Length and entropy beat complexity rules

Every password has a measurable amount of unpredictability, which security people call entropy. The more entropy, the more guesses an attacker has to make before stumbling onto yours. Two things drive entropy up: how many possible characters you draw from, and how many of them you string together. Length does the heavy lifting. Adding one more character multiplies the number of possible combinations, while adding one more symbol type only nudges it.

That's why a random 16-character password made of lowercase letters and numbers is far tougher than an 8-character one stuffed with symbols. Modern guidance from groups like CISA and the National Cybersecurity Alliance lands on the same number over and over: aim for at least 16 characters. Longer is better. If a site lets you go to 20 or more for important accounts, do it. The extra few seconds of typing buys you years of brute-force resistance.

Complexity rules, the kind that demand "one uppercase, one number, one symbol," exist mostly to stop people from choosing "password123." They don't make a genuinely random string meaningfully stronger. A truly random password already beats those rules without trying. So enable a few character types here for compatibility with picky login forms, then let length carry the weight.

Passphrases: long, random, and memorable

There's one case where you do need to remember a password yourself: the master password for your password manager, or the login to your computer. For those, a passphrase works beautifully. Pick four to six unrelated words at random, the more nonsensical the better, and string them together: something like "copper-lantern-drizzle-walnut." It's long, it has plenty of entropy, and your brain can actually hold onto it.

The key word is random. "Correct horse battery staple" is famous precisely because the words have no logical connection. A phrase pulled from a song lyric or a quote isn't random at all, since attackers feed exactly those sources into their guessing tools. For everything else, the accounts you log into a few times a year, you shouldn't be memorizing anything. That's a job for software.

Why reusing passwords is the real danger

Here's the statistic that should change how you think: a large share of data breaches trace back to reused or weak credentials. The mechanism is brutally simple. One website you signed up for years ago gets breached and leaks its password database. Attackers take those email-and-password pairs and try them on banks, email providers, and shopping sites, automatically, by the millions. This is called credential stuffing, and it works because so many people use one password everywhere.

The fix is a unique password for every single account. Do that, and a breach at one service stays contained to that service. The catch, of course, is that nobody can remember a hundred different random strings. Which is exactly the problem password managers solve.

Password managers and a second lock

A password manager generates and stores a unique random password for each of your accounts, fills them in for you, and asks you to remember just one master password. Tools like Bitwarden, 1Password, Proton Pass, and others encrypt your vault so that even the company running it can't read your logins. You get the security of long random passwords without the memory burden. For most people, adopting one is the single biggest upgrade they can make to their online safety.

Pair it with two-factor authentication, often shown as 2FA, on every account that supports it. With 2FA on, a stolen password alone isn't enough to get in, because the attacker also needs a code from your phone or a hardware key. App-based codes and physical security keys are stronger than text-message codes, but any second factor beats none. Password plus 2FA is a genuinely tough combination to defeat.

Why generating in the browser keeps it private

When this tool builds a password, it runs entirely on your device using your browser's built-in cryptographic random number generator, the same kind of secure source operating systems use for keys. The result never leaves your machine. There's no server call, no analytics ping carrying the value, nothing written to a log. You can confirm it by opening the page, switching off your network, and generating away. It still works, because everything happens locally.

That matters because a password you have to trust a remote server to create is a password that briefly existed somewhere you don't control. Generating locally removes that step entirely. Copy your new password straight into your password manager and you're done. While you're here, take a look at our all generators collection, or grab a random identifier from the UUID generator if you need one for development work.

Frequently asked questions