Free Tool
Secure Password Generator
Need a strong password? This generator builds one for you in your browser, using your device's cryptographic random number generator — the same kind of randomness your operating system uses for its own secrets. Choose a length and character sets, or generate a passphrase of random words, and copy the result straight into your password manager.
Generated locally, with real randomness. This tool uses crypto.getRandomValues, your browser's cryptographic random source — never the predictable Math.random. Nothing is sent to a server, stored or logged, and the page works offline once loaded.
What this tool does
A good password is one nobody can guess and no computer can brute-force in reasonable time — and the only honest way to get one is to generate it randomly. Human-chosen passwords follow patterns: a word, a capital at the start, a number at the end. Attackers know those patterns and try them first. A generated password has no pattern to exploit, because every character is chosen independently at random.
This generator gives you two kinds of password. The first is a random string: pick a length — 16 or 20 characters is a good default — and tick the character groups you want, and it builds a password from your device's cryptographic random number generator. The second is a passphrase: four or five ordinary words chosen at random from a built-in word list, which is easier to remember and type, and still strong enough for everyday use. Modern guidance from NIST supports both, and recommends passphrases for passwords people must remember.
Generated passwords are meant to be stored, not memorised. The right home for them is a password manager, which remembers them for you and fills them in. One password — your master password, a long passphrase — is the only one you need to remember. The guide linked below explains how to set that up in an afternoon.
Try it
Choose a type, set the options, and generate. The result appears below and is never sent anywhere.
Your new password: Press Generate password.
Nothing here is stored. Copy the result into your password manager and close the page when you are done.
How it works
Randomness is the whole job of a password generator, and not all randomness is equal. JavaScript's Math.random is designed for games and animations, and its output is predictable enough that an attacker who observes it can guess what comes next. This generator never uses it. Instead it calls crypto.getRandomValues, the cryptographic random source built into every modern browser, which draws on randomness collected by your operating system — hardware timings, interrupts and other unpredictable events. That is the same source your browser uses when it generates encryption keys.
For a random password, the generator picks each character independently from the character sets you ticked, so every position is equally unpredictable. For a passphrase, it picks each word independently from a built-in list of common words, so the sequence has no grammar or meaning to exploit. The number of possible outputs is enormous: a 20-character password from 95 characters has about 132 bits of entropy, and a five-word passphrase from a 7,700-word list has about 65 bits. Both are far beyond what an offline attacker can brute-force.
The generated password exists only in this page. It is shown on screen, it is copied only when you press the copy button, and it is never sent to a server, written to a file or saved anywhere. When you close the tab, it is gone — which is why you should put it in your password manager before you close the page.
Limitations
A generated password is strong, but strength is not everything. The generator cannot check whether a service accepts the password — some sites limit length or forbid certain symbols — and it cannot check whether the password was already exposed in a breach, although a freshly generated random password is extraordinarily unlikely to have been seen before. Most importantly, a generated password only helps if you store it safely: written on a sticky note or reused across accounts, it loses its value.
- Some websites reject passwords over a certain length or with certain symbols. If a generated password is refused, shorten it or remove symbols and generate again.
- The passphrase word list is small and built into the page; the words are ordinary English words chosen for memorability, not secrecy.
- The copy button needs your browser's permission to access the clipboard. If it fails, select the password and copy it yourself.
Examples
Example 1 — a 20-character random password. Length 20, all four character sets ticked. A typical result looks like k9#mQ2$vL8x!pR4&zW7 — twenty characters with no pattern, about 132 bits of entropy. Store it in your password manager and never type it by hand.
Example 2 — a four-word passphrase. Type set to passphrase, length 4. A typical result looks like correct horse battery staple — four random words, about 52 bits of entropy, and far easier to remember and type than a random string. It is a good choice for a master password or any password you must type regularly.
Example 3 — a PIN-style password for a device. Length 8, digits only. The result is eight random digits with about 27 bits of entropy — fine for a phone lock screen with lockouts, but far too weak for a website password. Use the length control to match the password to the job: longer where it guards an account, shorter only where lockouts protect it.
Frequently asked questions
Is a generated password safer than one I invent?
Yes, almost always. People invent passwords from words, names and patterns that attackers already try first. A generated password has no pattern, so an attacker has to guess at random — which is enormously harder.
Why does this generator use crypto.getRandomValues?
Because it is a cryptographic random source, designed for secrets. JavaScript's Math.random is predictable and must never be used for passwords or keys. This page uses the browser's secure source for every character and word it picks.
Should I use a random password or a passphrase?
Both are good. Random passwords are strongest and belong in a password manager. Passphrases are easier to remember and type, so they suit the one password you must remember — your password manager's master password.
How long should a generated password be?
At least 15 characters, per current NIST guidance, and 20 is a comfortable default. Longer is better and a password manager makes length painless, since you never type the password yourself.
Where should I store a generated password?
In a reputable password manager, protected by a long master passphrase and two-factor authentication. Never in a plain text file, an email to yourself, or a note on your phone.