Random password generator
Truly random passwords from 4 to 128 characters, with the letters, numbers and symbols you choose.
Generator
Made on this device with your browser's secure random generator. Never saved, never sent, no history.
Options
Site rules PRO
Make a list PRO
Password strength checker
Checked as you type, on this device. It isn't saved and is cleared when you leave.
Has this password leaked?
Tap Check to look it up in Have I Been Pwned's list of hundreds of millions of leaked passwords. Only the first 5 characters of its SHA-1 hash are sent, never the password.
Five rules for strong passwords
- Length beats tricks.Four or more random words, or 16+ random characters. Swapping a for @ adds almost nothing.
- One password per site.Reuse is how one leak opens every account.
- Let a password manager remember them.Your phone or browser has one built in.
- Turn on two-step sign-in.Use a passkey or an authenticator app where you can.
- Skip names, dates and patterns.Birthdays, pets, teams and qwerty are tried first.
Settings
What it does
Every character is picked with your browser's cryptographic random generator, with rejection sampling so each character is exactly as likely as any other. Nothing about you, the time or earlier passwords affects the result.
The meter shows the true entropy for your settings, counted exactly, and how long the password would take to crack at 10 billion guesses a second.
How to use it
- Choose a length with the slider, or type a number.
- Turn uppercase, lowercase, numbers and symbols on or off. Avoid look-alikes leaves out I, l, 1, O and 0.
- Tap Copy. Tap the arrows (or press R) for another.
Passwords are made on this device and are never saved, sent or kept in a history. Only your settings are remembered.
Good for
- Passwords for new accounts
- API keys, test accounts and shared secrets
- Sites that ban symbols or need a set length
- Random strings for codes and vouchers
Questions
How random are these passwords?
They use crypto.getRandomValues, the same source browsers use for encryption, with rejection sampling so there is no bias towards any character. Math.random is never used.
What if a site doesn't allow symbols?
Turn Symbols off and add a few characters of length instead. Each extra random letter or digit adds about 6 bits.
More generators and checks
Open the full Password Generator · Guide: How to create a strong password