Generate a strong random password
A strong password is ready as soon as the page opens. Change the length or the character types and a new one appears; click Copy password to put it on your clipboard. Passwords are generated in your browser and are never sent or stored anywhere.
What actually makes a password strong
Length and randomness. Every randomly chosen character multiplies the number of possible passwords an attacker has to try, and security people measure the result in bits of entropy. With all four character types switched on, this generator picks from 86 characters, so each one adds about 6.4 bits. Twelve characters give roughly 77 bits, sixteen give about 103 and twenty about 128. The strength meter shows that number for your current settings.
Clever substitutions do not help much. Password cracking tools try P@ssw0rd as early as they try Password, because they know people swap letters for symbols. A random string has no pattern to guess.
What the current guidance says
The US National Institute of Standards and Technology updated its digital identity guidelines (SP 800-63B-4) in August 2025. For passwords used on their own, without a second factor, it calls for at least 15 characters. It tells websites to accept passwords of at least 64 characters, to stop forcing rules like one capital and one symbol, and to stop making people change passwords on a schedule. In short: length matters more than complexity. The default here is 16 characters, which meets that bar.
Options and when to use them
- Character types. Each password always includes at least one character from every type you tick, so sites that still demand a number and a symbol accept it.
- Avoid look-alikes leaves out I, l, 1, O, 0 and o. Use it for passwords you will read aloud, type on a TV remote or print on a WiFi card. It removes a few characters from the pool, so add one or two characters of length to make up for it.
- If a site rejects symbols, untick Symbols and add three or four characters instead. Letters and digits alone still give about 6 bits per character.
Use it well
A strong password only protects one account if it is used for one account. Give every site its own password, keep them in a password manager so you never have to remember them, and turn on two-factor authentication for email, banking and anything that can reset your other passwords.
How the password is made
Characters are chosen with the browser's cryptographic random number generator, the same source used for encryption keys. The selection is unbiased, so no character is more likely than another. Nothing is sent over the network; once the page has loaded, it even works with your connection switched off.