Tool · Local generation
Pick the length and the character types and get a genuinely random key. It is generated on your device and disappears when you close the tab.
Cryptographic randomness
It is placed at a random position to help you remember the password. Careful: the part you choose adds no real security.
Generated with crypto.getRandomValues(), the browser's secure random source.
Your previous passwords will appear here.
History lives in memory only: reloading the page wipes it.
Are you still using your pet's name followed by a "123"? I get it, it's easy to remember, but you are laying down a red carpet for any bot. Today, a normal computer can crack an 8-letter password in less than a second.
The fix is not memorising hieroglyphs: it is length (16 characters or more), never reusing the same password twice, and turning on two-step verification wherever you can. That way a leaked site stays a leaked site.
When a person tries to invent something random, they fail. We tend to alternate consonants and vowels, avoid repeating characters in a row, start with a capital and finish with a digit or an exclamation mark. These are unconscious biases, and they are remarkably consistent from one person to the next.
Cracking software knows those biases and tries the combinations that follow them first. The upshot is that a password "made up at random" has, in practice, far less strength than its length suggests.
A generator has no preferences. Every character comes from a cryptographic randomness source, with no pattern anyone can get ahead of. That is the difference between looking random and being random.
| Use | Length | Why |
|---|---|---|
| Ordinary accounts | 16 characters | Beyond the reach of any realistic attack, and your manager types it for you. |
| Email, banking, manager | 20 or more | These are the accounts everything else is recovered from. |
| Services with a character limit | The maximum they accept | If the cap is low, turn on two-factor authentication without fail. |
If a site refuses to let you paste from your manager — it happens more than it should — use a passphrase of random words instead: it types cleanly and keeps its strength.
Generating an excellent password with nowhere to put it always ends the same way: it gets written on a note, forgotten, reset, and eventually replaced by the same old key.
Before you generate, decide where it is going to live. A password manager stores it, fills it in automatically and, as a side effect, protects you from phishing: on a fake site the manager does not recognise the domain and offers nothing. That hesitation is a free alarm.
Frequently asked
They come from the browser’s cryptography API, which is designed for security use, rather than from JavaScript’s ordinary random number generator, which is predictable and must never be used for this.
No. Generation happens on your device, nothing is sent to a server, and the history disappears when you close the page. Copy it into your manager before you leave.
Sixteen random characters cover any normal account with room to spare. For a master password or your main email, go to twenty, or use a passphrase of random words.
No, as long as you compensate with length. Some older services reject certain symbols; in that case add three or four more characters and the strength ends up the same or better.
Where to go next