Generated on your device, never sent anywhere
This page uses the browser's cryptographic random number generator. Nothing is transmitted, logged or stored, and the password disappears when you close the tab. You can disconnect from the internet, generate a password and it will still work.
What actually makes a password strong
Length beats complexity. A 16 character password from a mixed pool is far harder to crack than an 8 character one with a symbol bolted on the end. Entropy, shown above in bits, measures the real difficulty: above 80 bits is comfortable for most accounts, and above 110 is appropriate for email, banking and password manager master keys.
Three habits that matter more than the password itself
- Never reuse a password across sites. One breach then unlocks everything.
- Use a password manager so you never have to remember or write them down.
- Turn on two factor authentication, which protects you even if the password leaks.
Frequently asked questions
Are these passwords stored or sent to a server?
No. They are created locally by your browser's crypto API and never leave your device.
How long should a password be?
Sixteen characters is a sensible default. For email, banking and your password manager, go to twenty or more.
What does entropy in bits mean?
It estimates how many guesses an attacker needs. Every extra bit doubles that number, so higher is better.