Build a random password with the length and character sets you need. It is generated locally with a cryptographically secure random source.
Runs in your browser — nothing is uploaded
Passwords are generated with your browser's cryptographic random source and are never sent anywhere. Use 16 or more characters for accounts you care about.
A good password is long and unpredictable. This generator draws every character from the browser’s cryptographic random number generator, the same source used for TLS keys, and it guarantees at least one character from each set you selected so the result meets common site rules.
Entropy is a measure of how many guesses an attacker needs on average. The bit count shown above is length multiplied by the log of the character pool size. Each extra character adds more strength than adding an extra symbol to a short password, which is why length is the setting that matters most.
Passwords are created in the page and never transmitted. Copy the value into your password manager straight away, and generate a new one whenever you change the length or sets, or simply click Generate again.
Sixteen characters from the full character set is a strong default for most accounts, which gives roughly 100 bits of entropy. Password managers make longer values practical, so 20 or more is reasonable for email, banking and developer accounts that protect other systems.
Yes, as long as your device is clean. This page creates the password in your browser and never sends it anywhere, so no server can log it. Keep in mind that the value is visible on screen, so generate it in a private environment and store it right away.
Many websites reject passwords that lack a digit or a symbol. Forcing at least one character from every selected set satisfies those rules without making the rest of the password predictable, because the remaining characters are drawn from the combined pool and the whole string is shuffled.
The symbol set is !@#$%^&*()-_=+[]{};:,.? . It avoids quotes, backslashes, slashes and spaces, which often break copy-paste, shell commands and some legacy forms. Turn the symbol set off entirely if a site forbids symbols.
It is log2 of the number of possible passwords the generator can produce with your settings. Around 80 bits is already beyond practical brute force for most services, and 100 bits or more leaves a generous margin against attackers who steal a password database. The figure assumes the password is truly random, which a human-chosen password is not.
No. The length and character choices live in the page state only and are cleared when you leave. Nothing is written to cookies, local storage or a server.