Password Generator
Create strong, random passwords instantly. They're made on your device and never sent anywhere.
Passwords are generated with your browser's secure random number generator and are never stored or sent.
How to use the password generator
A strong password is your first line of defense against hackers. This free tool creates strong, random passwords instantly, right on your device.
- Choose the length. 16 characters or more is a good choice for most accounts.
- Choose which characters to include: uppercase, lowercase, numbers and symbols.
- Optionally, avoid look-alike characters like I, l, 1, O and 0 if you'll ever need to type the password by hand.
- Press Copy to copy your password, or pick one of the extra options below it.
Each password always includes at least one character from every type you select.
Is this password generator safe?
Yes. Passwords are created in your browser using its cryptographically secure random number generator (the Web Crypto API). They're never sent over the internet, saved or logged. Once you leave the page, they're gone, so copy your password into your password manager or the site you're signing up for.
What makes a password strong?
Password strength comes from length and randomness. Security experts measure this as entropy, in bits. Each extra bit doubles the number of guesses an attacker would need.
| Password | Possible characters | Approximate entropy |
|---|---|---|
| 8 lowercase letters | 26 | 38 bits (weak) |
| 12 mixed letters and numbers | 62 | 71 bits (strong) |
| 16 letters, numbers and symbols | 86 | 103 bits (very strong) |
| 20 letters, numbers and symbols | 86 | 129 bits (very strong) |
Notice that length matters more than complexity. Adding a few extra characters increases strength much more than swapping a letter for a symbol.
Password best practices
- Use a unique password for every account. If one site is breached, attackers often try the same password on other sites.
- Use a password manager to store your passwords securely, so you only need to remember one strong master password.
- Turn on two-factor authentication (2FA) wherever possible. It protects you even if a password leaks.
- Don't use personal information like names, birthdays or pet names, which are easy to guess.
- Avoid common patterns like "Password123", keyboard runs like "qwerty", or simple substitutions like "P@ssw0rd".
- Change a password right away if you think it's been exposed in a data breach.
Passwords vs. passphrases
A passphrase is several random words strung together, like "lamp-orbit-candle-river". Passphrases can be strong and easier to remember, which makes them good for a password manager's master password. For everyday accounts stored in a password manager, a long random password like the ones this tool creates is ideal, since you never need to remember it.
Frequently asked questions
How long should a password be?
At least 12 characters, and 16 or more for important accounts like email and banking. Longer passwords are much harder to crack.
Are generated passwords stored anywhere?
No. They're created in your browser and never sent, saved or logged. Copy your password before leaving the page.
Should I include symbols in my password?
Yes, if the site allows them. Symbols increase the number of possible characters, which adds strength. If a site rejects certain symbols, turn symbols off and use a longer password instead.
What does "avoid look-alike characters" do?
It removes characters that are easy to confuse, like capital I, lowercase l, the number 1, capital O and the number 0. This helps if you need to read or type the password by hand.
How often should I change my passwords?
Current security guidance suggests changing a password when there's a reason to, such as a data breach or suspected compromise, rather than on a fixed schedule. Using unique, strong passwords matters most.