How long should my password be?

Most security guidelines now recommend at least 12–16 characters. Longer passwords are exponentially harder to brute-force than adding more character types, so length matters more than complexity alone.

Are these passwords actually random and secure?

Yes. The generator uses your browser's built-in cryptographically secure random number generator (Web Crypto API), not a predictable pseudo-random function, and everything runs locally — no password is ever transmitted or logged.

Should I reuse a strong password across sites?

No. Even a very strong password should be unique per site. If one service is breached, reused passwords let attackers access your other accounts. Use a password manager to store unique generated passwords for every account.

Why include symbols and numbers?

Mixing character types increases the total pool of possible characters at each position, which increases the number of guesses an attacker needs to try. Combined with sufficient length, this makes brute-force attacks impractical.

Password Generator — Create a Strong Password

Generate strong, random passwords with customizable length and character sets.

Strength: Strong

Length16

UppercaseLowercaseNumbersSymbols

How to use the Password Generator

Drag the Length slider to anything from 6 to 64 characters — longer is stronger.
Tick the character types to include: uppercase, lowercase, numbers, and symbols.
Check the strength rating, press Generate new password until you get one you like, then Copy it straight into your password manager.

About the Password Generator

A password generator creates a random string of characters that's much harder to guess or crack than a password a person would choose, such as a name, date, or dictionary word. Strong, unique passwords are one of the simplest defenses against account takeover, since attackers can't reuse a leaked password from another site if every account has a different one.

This generator lets you choose the exact length and which character types to include — uppercase letters, lowercase letters, numbers, and symbols — so you can match the requirements of any signup form while keeping the result as random as possible. Generation happens using your browser's cryptographically secure random number source, and nothing is ever sent over the network.

Worked example

Example: setting length to 16 with uppercase, lowercase, numbers, and symbols enabled might produce something like 'qT7$mK2!vB9@xR4h' — a password that would take a modern computer an impractically long time to brute-force, compared to a common password like 'password123'.

What actually makes a password strong

Strength is measured in bits of entropy: length × log₂(pool size), where the pool is how many different characters each position could be. This generator's pools are 26 lowercase letters, 26 uppercase, 10 digits, and 26 symbols — 88 characters with everything enabled. A 16-character password from all 88 has about 103 bits of entropy; a 12-character password of letters and digits (62 characters) has about 71; an 8-character all-lowercase password has only about 38, which modern cracking hardware can exhaust quickly.

Notice which lever matters more. Going from 62 to 88 characters at length 16 adds about 8 bits. Adding four more characters of length adds about 26. When a site restricts symbols, simply make the password longer: 20 letters and digits (about 119 bits) beats 16 characters with symbols.

How the generator picks characters

Each character is drawn independently from the combined pool using your browser's cryptographically secure random source. Ticking a character type makes it available, not mandatory, so a short password can occasionally come out without a digit or symbol. If a sign-up form insists on one of each, generate again — the next result will almost certainly qualify — rather than editing the password by hand, which makes it less random.

Using generated passwords day to day

Store them in a password manager; generated passwords are meant to be pasted, not memorized.
For the few secrets you must type from memory — the manager's own master password, a device login — a passphrase of five or six random words is easier to remember and still very strong.
Turn on two-factor authentication for important accounts. A strong password doesn't help if it's typed into a phishing page.
Never reuse a generated password on a second site; uniqueness is what stops one breach spreading to your other accounts.

Frequently asked questions

How long should my password be?: Most security guidelines now recommend at least 12–16 characters. Longer passwords are exponentially harder to brute-force than adding more character types, so length matters more than complexity alone.
Are these passwords actually random and secure?: Yes. The generator uses your browser's built-in cryptographically secure random number generator (Web Crypto API), not a predictable pseudo-random function, and everything runs locally — no password is ever transmitted or logged.
Should I reuse a strong password across sites?: No. Even a very strong password should be unique per site. If one service is breached, reused passwords let attackers access your other accounts. Use a password manager to store unique generated passwords for every account.
Why include symbols and numbers?: Mixing character types increases the total pool of possible characters at each position, which increases the number of guesses an attacker needs to try. Combined with sufficient length, this makes brute-force attacks impractical.