How this password generator works
Every press of the button builds a password from the character sets you have ticked, at exactly the length you set — 16 characters by default, anywhere from 4 to 64. Two properties separate a generator you can trust from a toy. First, the randomness: each character is chosen using your browser's cryptographically secure random number generator (the same source used for security tokens), not the ordinary Math.random function, which is predictable enough that security tools warn against it for credentials. Second, the guarantee: the result always contains at least one character from each set you selected, so a password asked to include symbols cannot come out as letters and digits only because chance never picked one — a failure mode of simpler generators that quietly weakens the result. All of it happens on your device. No password is transmitted, logged or stored by this site; when you close the tab, the only copy is the one you saved.
How long should a password be?
Length beats cleverness. Each added character multiplies the number of possibilities, so a long password of ordinary characters outperforms a short one crammed with symbols. Practical guidance:
| Length (all four sets on) | Sensible use |
|---|---|
| 12 characters | Minimum worth using for accounts that matter — email, banking |
| 16 characters | The default here; a strong general-purpose choice |
| 20+ characters | Password-manager entries and anything guarding money or identity |
| Under 10 characters | Only where a site forces it — and a warning sign about that site |
If a service rejects symbols, untick them rather than shortening the password — a longer letters-and-digits password still beats a short one with a single exclamation mark. And where you must type a password regularly (a phone unlock, a streaming box), consider generating at 12–14 characters and saving the longer ones for accounts your password manager types for you.
Use a generated password properly
A strong password only protects the one account it belongs to. The three habits that make generation worthwhile: never reuse a password across sites — a breach at the least careful site you use then compromises all of them, which is the entire mechanism of credential-stuffing attacks; store it in a password manager (your browser's built-in manager counts) rather than a notebook or a sticky note, so a 20-character random string is something you never have to memorize or type; and turn on two-factor authentication wherever it is offered, so the password is not the only barrier. Generating here and then saving immediately is the right order — generate, copy, paste into the account's change-password form, save it in your manager, and only then move on. A brilliant password that was never saved is just a lockout with extra steps.
Frequently asked questions
Are the passwords stored or sent anywhere?
No. Passwords are generated in your browser, on your device, and this site never receives, logs or stores them. When you leave the page, the generated password exists only where you pasted or saved it.
Why does the generator insist each selected set appears?
Because sites often require, say, a symbol — and pure chance can produce a long password with none. Guaranteeing at least one character from each set you ticked means the result always satisfies the policy you had in mind, while the remaining characters stay fully random.
Is 16 characters really enough?
With all four character sets, 16 random characters give roughly 105 bits of entropy — far beyond brute-force reach with current technology. The far more common failure is reuse across sites, which no length can fix; unique per account matters more than extra length.
A site says my password is too long or rejects a symbol. What then?
Lower the length to the site's maximum (keep it at 12 or above if allowed) or untick Symbols and regenerate. Some older systems cap passwords at 16 characters or reject characters like < or > — length first, then set restrictions, is the order to adjust.
Private by design: this generator runs entirely in your browser. The passwords you create here are never uploaded, stored, logged or shared — by design, we could not show them to anyone if we wanted to.