How to use the Password Generator tool
- Pick a lengthDrag the slider. We recommend at least 16 characters for important accounts.
- Choose character typesInclude uppercase and lowercase letters, numbers and symbols, and optionally avoid look-alike characters.
- Copy your passwordClick Copy and paste it into the sign-up form, then save it in your password manager.
Built for real security
- Secure randomnessUses the Web Crypto API (crypto.getRandomValues), the same source of randomness browsers use for encryption.
- No biasRejection sampling makes every character equally likely, a detail many simple generators get wrong.
- Every set guaranteedEach password contains at least one character from every type you select, so it passes strict site rules.
- Strength meterShows the estimated entropy in bits so you can see how much harder each extra character makes guessing.
- Bulk generationCreate 5, 10 or 20 passwords at once, for example when setting up several accounts or Wi-Fi networks.
- Readable optionAvoid characters that are easy to confuse, such as l, 1, I, O and 0, when a password must be typed by hand.
What makes a password strong?
A strong password is long, random and unique. Attackers rarely guess passwords one at a time by hand. Instead, they use software that tries billions of combinations, starting with dictionary words, names, dates and passwords leaked in earlier data breaches. A password made of truly random characters defeats these shortcuts, and every extra character multiplies the number of possibilities.
Length matters more than complexity. A 16-character random password made of letters, numbers and symbols has roughly 100 bits of entropy, which is far beyond what can be brute-forced with today’s hardware. An 8-character password, even with symbols, has about 50 bits and is within reach of a determined attacker with offline access to a leaked password database.
Understanding the strength meter
The meter shows entropy, measured in bits. It is calculated as the password length multiplied by log2 of the number of possible characters. Each additional bit doubles the number of guesses an attacker would need.
| Entropy | Rating | Suitable for |
|---|---|---|
| Below 36 bits | Weak | Not recommended |
| 36–59 bits | Fair | Low-value accounts only |
| 60–79 bits | Strong | Most online accounts |
| 80+ bits | Very strong | Email, banking, password manager master password |
Password best practices
- Use a different password for every account. If one site is breached, attackers try the same email and password on other sites. Unique passwords stop this “credential stuffing”.
- Use a password manager. You only need to remember one strong master password. The manager remembers the rest and fills them in for you.
- Turn on two-factor authentication (2FA). Even a perfect password can be phished. A second factor, such as an authenticator app or security key, blocks most account takeovers.
- Don’t change strong passwords on a schedule. Current guidance from security bodies such as NIST recommends changing a password only if there is a sign it has been compromised.
- Never share passwords by email or chat. Use your password manager’s secure sharing feature instead.
Is it safe to generate passwords online?
It is safe when the generator runs entirely in your browser, as this one does. The password is created by your own device using the cryptographically secure random number generator built into every modern browser. It is never sent over the network, logged or stored, so no one else ever sees it. You can verify this by loading the page, disconnecting from the internet and generating passwords offline.