A password generator produces random strings you would never invent yourself — which is the point, because human-chosen passwords cluster in patterns that cracking tools try first. This one generates entirely in your browser using a cryptographic random source.
Random or passphrase
| Random string | Passphrase | |
|---|---|---|
| Example | K7#mQ9$xL2vN | anchor-velvet-purple-tandem |
| Entropy | ~78 bits at 12 characters | ~52 bits at 4 words |
| Typeable by hand | Painful | Easy |
| Best for | Anything stored in a manager | Master passwords, device unlock, anything you type |
Use random strings for the hundreds of accounts your password manager fills for you, and a long passphrase for the handful you must type from memory — the manager's master password above all.
How much entropy is enough
| Use | Suggested |
|---|---|
| Low-value account | 12 characters |
| Email, banking, cloud storage | 16+ characters |
| Password manager master | 6+ word passphrase |
| Encryption key or server credential | 20+ characters |
Your email account deserves the strongest protection you give anything, because it is the reset path for everything else. An attacker with your email does not need your other passwords.
Why generated beats invented
People asked to choose a random password produce highly non-random results: a capital at the start, a digit and a symbol at the end, a dictionary word in the middle, and a personally meaningful number. Cracking tools model these patterns explicitly, which is why a human-chosen 10-character password is typically far weaker than a generated 10-character one.
Character sets and site restrictions
Some sites reject certain symbols or cap length — both are signs of poor password handling, since a correctly hashed password can be any length and contain anything. Where a site imposes limits, compensate with maximum permitted length rather than dropping to a weaker password. If a site emails you your password in plain text, it is storing it unhashed, and you should assume it will eventually leak.
Excluding visually ambiguous characters — 0/O, 1/l/I — is worth doing when a password will be read aloud or typed from a screen, at a small cost in entropy.
What matters more than the password
- Uniqueness. Reuse is the leading cause of account takeover. One breached site should not endanger any other.
- A password manager. It is the only practical way to have unique strong passwords everywhere.
- Two-factor authentication. An app or hardware key protects the account even when the password leaks.
- Passkeys, where offered — nothing is shared, so nothing can be stolen or phished.
Generation and privacy
This generator uses your browser's cryptographic random source, and the result never leaves your device — nothing is transmitted, logged or stored. That is a property worth verifying in any password generator you use: a generator running on a server necessarily knows every password it produces.