Password generator: strong random passwords in one click

What makes a random password generator secure?

Two things: length and real randomness. A password like Summer2026! passes every form rule (capital letter, number, symbol) but sits in every dictionary list attackers try first. A password of 16 random characters has about 100 bits of entropy. That means 2 to the power of 100 possibilities, more than a nonillion. Even at a billion guesses per second it would take longer than the age of the universe. This password generator uses crypto.getRandomValues, the cryptographically secure random source of your browser, not Math.random. That is the difference between a die and a calculator.

How long should a generated password be? 8, 12, 15 or 16 characters

Eight characters is the minimum many sites still accept, but with all character types it gives only about 50 bits, which a modern GPU rig cracks offline in days. A 12-character password with uppercase, lowercase, numbers and symbols reaches about 75 bits and is fine for everyday accounts. Fifteen characters give roughly 94 bits, sixteen characters about 100 bits, which is what we recommend for email, banking, admin logins and the master password of a password manager. Move the slider and the bit counter updates live, so you can see exactly what one extra character buys you.

How do you read the strength meter in bits?

Entropy is length multiplied by the logarithm of the number of characters that were available. Under 40 bits a password is cracked in minutes. From 60 bits you are safe against online attacks, because services lock accounts after a few failed attempts. From 80 bits it also withstands offline attacks on stolen databases. For a strong password generator result that lasts for years, aim for 100 bits and more: 16 characters with all character types, or a passphrase with 6 words plus a number.

When is a password generator with words the better choice?

Whenever you have to remember the password or type it regularly. "Birch-Comet-Nimble-Harbor-Dwarf-47" has over 60 bits and sticks after typing it three times. The built-in list contains about 400 harmless English words: animals, plants, colors, everyday objects, no swear words, no brand names. With 5 words you get about 43 bits, with 6 words plus a number about 58 bits, with 8 words about 69 bits. For the master password of your password manager take 7 or 8 words. Everything else can be a 20-character random string the manager stores for you.

What mistakes do most people make with passwords?

The biggest mistake is reuse. When a single online shop is breached, attackers automatically try the same email and password combination at Amazon, PayPal, Google and Microsoft. That is why every service needs its own password, and exactly what the option "how many" is for: generate 10 passwords, paste them into your manager, done. Second mistake: patterns. Qwerty123, birthdays, team names and keyboard rows are all in the lists. Third mistake: forced regular changes. They lead to Password1, Password2, Password3. Better to keep one strong password for a long time and change it only after a known leak.

What is the option "no similar characters" for?

Capital I, lowercase l and the digit 1 look identical in many fonts, as do capital O and zero. If you have to read a password aloud, copy it by hand or print it on a card for the guest Wi-Fi, this option saves trouble. The pool shrinks by only 5 characters and the entropy of a 16-character password drops by less than 2 bits. For passwords that only live in your manager, leave it off.

Why can you trust this secure password generator?

Because it knows nothing. The complete code runs in your browser, there is no request to our server containing the password, no log and no cookie for it. You can load the page, go offline and only then generate. The same principle applies to our other tools: the word counter and the WhatsApp chat cleaner work just as locally, and Export a Claude chat converts shared Claude conversations without storing them.