Password Generator
Generate strong, random passwords with custom length and rules.
How to use this tool
Why use this tool
FAQ
Are generated passwords stored?
How long should a password be?
What is password entropy?
Should I use a password manager?
Are passphrases (word-based passwords) secure?
About Password Generator
Reusing passwords is the most common cause of account compromise. When any one site you use suffers a data breach, attackers try your email and password on every other site automatically — a technique called credential stuffing. The solution is a unique, randomly generated password for every account. This generator creates them instantly using your browser's cryptographic random number generator, so they are truly unpredictable and never transmitted anywhere.
What Makes a Password Strong
Password strength is measured in entropy — the number of bits of unpredictability. A 12-character password using only lowercase letters has about 56 bits of entropy. Add uppercase, digits, and symbols, and the same 12 characters reach 79 bits. Extend to 20 characters, and entropy exceeds 130 bits — effectively uncrackable with current technology. NIST's 2024 guidance recommends prioritising length over complexity and abandoning mandatory character-type requirements, which lead users to predictable patterns like Password1!.
How to Use Generated Passwords
Generate the password here, copy it, then paste it directly into a password manager (Bitwarden, 1Password, or your browser's built-in manager) and save it alongside the account credentials. Never type a random password from memory — that defeats the purpose. Your master password (for the password manager itself) should be a long passphrase you have memorised: four or more random words selected without any personal connection to you.
Symbols and Site Compatibility
Some websites accept only specific special characters or cap password length at an embarrassingly short limit — a sign the site may be storing passwords insecurely. If a generated password is rejected, try disabling symbols first. If it is still rejected, the site likely has a character limit; shorten the password. Never use a password shorter than 16 characters for any account containing personal or financial information.