Secure password generator

This is a free password generator. Pick how long the password should be, tick the character types you need, and it returns a strong random password you can copy in one click. There is no account to create, no e-mail to give, and nothing you generate is stored.

How long should a password be?

Length is what protects a random password. It has no pattern to guess, so an attacker has nothing better than trying every possibility — and each character you add multiplies how many possibilities there are. Making a short password “cleverer” with a symbol or two does far less than making it longer.

Strength is measured in bits of entropy: the number of random choices that went into the password. Every extra bit doubles the guessing work. Here is what each length is worth with letters and digits, which is what this generator uses by default:

Length	Entropy	Strength	What it suits
12	71 bits	Medium	The practical floor, for a password you must type by hand
16	95 bits	Strong	An account you sign into often
20	119 bits	Strong	Anything holding money or personal data
24	143 bits	Very strong	The default — anything a password manager fills in for you
32	190 bits	Very strong	Long-lived secrets: API keys, service accounts, backups

Adding symbols raises those figures: 16 characters go from 95 to 103 bits, and 24 characters from 143 to 155. Useful, but notice that four extra characters would have bought you more than symbols do.

Which characters should you allow?

Allow every type the site you are signing up to will accept. In practice that is where the trouble is: symbols are the ones most often refused, and some systems quietly truncate or mangle them instead of saying so. If a password stops working right after you set it, that is usually why. Turn symbols off and add four characters instead — you end up at the same strength, with none of the risk.

Leaving out lookalike characters is worth it when the password will be read off one screen and typed into another, or dictated to someone. The option removes the characters routinely mistaken for one another: capital O against zero, lowercase l against uppercase I against the digit one. It costs a little entropy and saves a lot of retyping.

Is it safe to generate a password on a website?

It depends on what the site does with it, so here is exactly what happens here. The password is drawn from a cryptographically secure random source — not from anything predictable like the time of day — and returned to you over an encrypted connection. It is not written to a database, not written to a log, not indexed, and not attached to any identity: your settings come in, one password goes out, and nothing of either is kept.

The honest trade-off: because the password is produced on our side rather than in your browser, it crosses the network once inside that encrypted connection. For the overwhelming majority of accounts that is a non-issue. For the two or three secrets where you would rather nothing ever left your own machine — a disk encryption key, the master password of your vault — use a generator that runs offline instead. That is the right answer, and it is not this page.

What makes a password strong?

Three things, in this order. It must be random: anything you invent yourself carries patterns, and password crackers know them all, including the substitutions that feel clever. It must be long, because length is what turns randomness into time an attacker cannot afford. And it must be unique, because the strongest password in the world protects nothing on the day another site leaks the copy you reused there.

What does not make a password strong: capital letters in predictable places, a digit tacked on the end, a symbol swapped for a letter it resembles, or a rule that made you change it every ninety days.

Frequently asked questions

Is this password generator free?

Yes, with no account and no limit. Generate as many as you need.

Can I get the same password twice?

Not deliberately, and it will not happen by accident either — at these lengths the number of possibilities is far beyond anything that repeats. Nothing is remembered between requests, so reloading gives you a fresh one. Copy it before you leave the page.

Do you store the passwords you generate?

No. They are never written down on our side, in any form. Once the page has been served, the password exists only where you put it.

Is a passphrase better than a random password?

A passphrase — several words picked at random — is easier to remember and just as strong once it is long enough. It is the right choice for the handful of passwords you actually have to type from memory. For every other account, the ones a password manager fills in for you, a random string reaches the same strength in fewer characters.

How often should I change my passwords?

Only when there is a reason: a breach at the site, a shared password, a login you do not recognise. Scheduled changes every few months were dropped from security guidance years ago, because they push people towards small predictable edits of the password they already had.

Where should I keep them?

In a password manager. It is the only realistic way to hold a different long random password per account, and it removes the reason people reuse them in the first place.