Strong Password Generator

What this password generator does

This tool creates strong, random passwords in your browser. You choose the length and which character sets to include (uppercase letters, lowercase letters, numbers and symbols), then generate as many passwords as you need. Randomness comes from your browser's cryptographic random number generator, and the password is created on your device; it is not sent to our server.

It is for anyone creating a new account, IT admins issuing temporary passwords, developers who need test credentials or random secrets, and people replacing weak or reused passwords.

How to generate a password

1. Set the Length. The default is 16 characters; any length from 8 to 64 is accepted (values outside that range are adjusted automatically).
2. Tick the character sets you want: Uppercase, Lowercase, Numbers and Symbols. All four are on by default.
3. Click Generate.
4. Click Copy and paste the password into the sign-up form or your password manager.
5. Click Generate again whenever you want a different password.

How the generated passwords are built

• At least one character from every set you select is included, and the characters are then shuffled.
• Characters that are easy to confuse are left out: lowercase l, uppercase I and O, and the digits 0 and 1. This makes passwords easier to read and type by hand.
• The symbol set is ! @ # $ % * - _ ?. These are accepted by most websites.

How strong is it?

Strength comes mainly from length and from the number of possible characters. With all four sets enabled there are 66 possible characters, which gives roughly 6 bits of randomness per character. A 16-character password therefore has around 96 bits of randomness, far beyond what can be guessed by trying combinations. Each extra character multiplies the number of possibilities, which is why length matters more than complexity.

What current guidance says

The US National Institute of Standards and Technology updated its digital identity guidelines (NIST SP 800-63B, Revision 4, 2025). Among other points, it says services should require at least 15 characters for passwords used as the only authentication factor, should allow passwords of at least 64 characters, should not force arbitrary composition rules, and should not require periodic password changes unless there is evidence of compromise. The practical lesson for users: long, unique, random passwords stored in a password manager, plus two-factor authentication where available.

Common use cases

• Creating a unique password for every new online account.
• Replacing a password that was reused or exposed in a data breach.
• Setting Wi-Fi passwords, router admin passwords and device PINs.
• Generating temporary passwords for new staff accounts.
• Creating random strings for test environments and development.

Tips and common mistakes

• Use a different password for every site. Reuse lets one breach unlock many accounts.
• Go longer when you can. If a password is stored in a password manager, 20 or more characters costs you nothing extra.
• Turn off symbols if a site rejects them. Some older systems restrict special characters. Increase the length to compensate.
• Don't email or message passwords in plain text. Use a password manager's secure sharing feature instead.
• Enable two-factor authentication for important accounts. A strong password plus a second factor is much harder to break into.
• Save it right away. The tool does not store passwords, so copy the password into your password manager before you leave the page.

Frequently asked questions

Is it safe to use an online password generator?

This one generates passwords in your browser using the Web Crypto random number generator and does not send them to our server. As with any tool, use it on a device you trust.

How long should my password be?

Longer is better. Current NIST guidance asks services to require at least 15 characters when a password is the only factor. For randomly generated passwords stored in a manager, 16 to 24 characters or more is a comfortable choice.

Why are some letters and numbers missing?

Look-alike characters such as l, I, O, 0 and 1 are excluded so passwords are easier to read and type correctly.

Do you store the passwords I generate?

No. The password exists only in your browser until you copy it.

Should I change my passwords regularly?

Current NIST guidance says services should not force periodic changes, but you should change a password immediately if it may have been exposed.

What is better, a random password or a passphrase?

Both can be strong if they are long and truly random. A random password is ideal for storage in a password manager; a long passphrase of random words can be easier to remember for the few passwords you must type from memory.

Related tools

• SHA Hash Generator – see how text is turned into a one-way hash.
• UUID Generator – create random unique identifiers.
• Character Counter – check the length of a password or text.
• MD5 Hash – create MD5 checksums for legacy systems.