Made on your device, never sent anywhere
This generator runs entirely in your browser using the same cryptographic randomness your device uses for encryption. The password on screen has never travelled over the internet, is not logged, and disappears when you leave the page. That matters: a password only you have ever seen is the only kind worth using.
Length beats complexity
Password strength is measured in entropy: how many guesses an attacker would need. Every character you add multiplies the search space, which is why length is the single biggest lever:
The three rules that actually matter
- Unique everywhere. The real-world danger is not guessing but reuse: one leaked site hands attackers your password for every other site you used it on.
- Long. 16 characters minimum for accounts that matter; more costs you nothing when a manager does the typing.
- Stored in a password manager. Browser and phone password managers are free and safe. Let them remember; you remember one master password.
Where a site offers two-factor authentication, switch it on. A strong password plus a second factor is the combination that ends most account takeovers.
Frequently asked questions
Is my password sent to a server?
No. Passwords are generated by JavaScript running on your own device, using your browser's cryptographic random number generator. Nothing is transmitted, logged or stored, and refreshing the page destroys what was on screen.
How long should a password be?
16 characters or more for anything that matters. Length beats cleverness: every extra character multiplies the work an attacker must do, which is why a long password of plain letters can be stronger than a short one full of symbols.
Do I really need symbols?
Symbols help, but length helps more. A 20-character password of letters and numbers is far stronger than a 10-character one with symbols. Include symbols when the site allows them, but never at the cost of length.
How am I supposed to remember passwords like this?
You are not. Use a password manager (the ones built into iPhone, Android and modern browsers are fine) and let it remember a unique random password for every site. You then only memorise one strong master password.
What makes a generated password stronger than one I invent?
Humans are predictable: names, dates, keyboard walks and word-plus-number patterns are all in every attacker's dictionary. A random generator has no patterns to exploit, so the only attack left is brute force, which length makes impractical.