Password Generator
Generate strong passwords using your browser's cryptographically secure RNG.
A long, sufficiently random password is one of the simplest and most effective defenses against brute-force and dictionary attacks. This tool uses the browser's built-in Web Crypto API (crypto.getRandomValues), a cryptographically secure pseudo-random number generator (CSPRNG) — not Math.random(), which is predictable and not suitable for security purposes.
FAQ
How long should a password be?
As a rule of thumb, use at least 12-16 characters combining uppercase, lowercase, digits, and symbols. Every extra character increases the time needed to brute-force it exponentially. For high-value accounts (email, password manager master password), 16+ characters is recommended.
Is a password generated here actually secure?
Yes. It's generated entirely in your browser using crypto.getRandomValues, a cryptographically secure random number generator. Nothing is sent over the network, logged, or stored — it disappears once you close the page.
Why not just use a memorable password?
Memorable passwords (birthdays, common words) are exactly what dictionary attacks and social engineering target first. It's safer to generate a random, unique password for every account and keep them in a password manager.