Password Generator
This tool uses the browser-built-in Web Crypto API to generate true cryptographic randomness — passwords are never stored or sent to any server. Choose the length and character types, then click to copy instantly.
| Level | Length | Required variety |
|---|---|---|
| Weak | Less than 8 | Lowercase only |
| Medium | 8–11 | Letters + numbers |
| Strong | 12–15 | Uppercase + numbers + symbols |
| Excellent | 16–20 | All character types and symbols |
| Very strong | 20+ | Fully random — go for it! |
Are generated passwords secure?
Yes — the tool uses crypto.getRandomValues (Web Crypto API), which provides true cryptographic randomness. Nothing is stored or sent to any server.
What is a good length for a strong password?
The recommended minimum is 12 characters with numbers and symbols. 16 or more characters with varied types is considered very strong by NIST 2024 guidelines.
How do I copy the password?
Click on the displayed password and it will be copied automatically to your clipboard with a "Copied ✓" message.
Should I use a password manager?
Strongly yes. Tools like Bitwarden (free), KeePass and NordPass store strong, unique passwords for every site without you needing to memorise them.
What is the difference between a password and a passphrase?
A passphrase is a string of random words like "correct-horse-battery-staple" — longer, easier to remember and harder to crack than a short complex password.
How often should I change my password?
NIST does not recommend mandatory periodic changes. Change it immediately after a breach or suspected compromise. The key habit is using a unique password for every site.
What are the most dangerous password attacks?
Brute force (trying all combinations), Dictionary attack (trying common words), and Credential stuffing (using leaked credentials from other sites). A long, unique password defeats all of them.
Are special characters always necessary?
Not necessary if the password is long (20+ random characters). They do significantly increase complexity for shorter passwords. Some sites do not accept them — just turn the option off in that case.
Password Generator — What Makes a Password Strong?
Password strength is measured by entropy — the number of possible combinations. A 12-character password using uppercase, lowercase, numbers and symbols has over 475 quadrillion possible combinations, making it practically impossible to brute-force. Length matters more than complexity: "correct horse battery staple" is stronger than "P@ssw0rd".
Recommended password practices
- Use at least 16 characters for critical accounts (email, banking)
- Never reuse a password across more than one site
- Store passwords in a password manager (Bitwarden, 1Password, KeePass)
- Enable 2-factor authentication (2FA) wherever available
Privacy note
Passwords generated here are created entirely in your browser using JavaScript's cryptographic random number generator. Nothing is sent to any server. The tool has no memory — each page load generates fresh passwords.