Strong Random Password Generator
Create strong, secure passwords instantly. Free, private — generated in your browser, never sent anywhere.
How to use the password generator
- Set the length with the slider. 16 or more is recommended.
- Choose the character types: uppercase, lowercase, numbers and symbols. Tick Avoid look-alike characters if you will type the password by hand.
- Click Generate Password. A new password also appears whenever you change an option.
- Click Copy and save it straight into your password manager or the sign-up form.
How it works
Each character is chosen with crypto.getRandomValues. To avoid modulo bias, where some characters would come up slightly more often, random numbers that fall outside an exact multiple of the character-set size are thrown away and redrawn. The generator first takes one character from each type you selected, fills the rest from the combined set, and then shuffles the result with a secure Fisher–Yates shuffle.
Entropy (bits) = length × log2(character-set size)
| Length | Character set | Entropy (approx.) |
|---|---|---|
| 8 | Lowercase only (26) | 38 bits |
| 12 | Upper + lower + digits (62) | 71 bits |
| 16 | All four types (88) | 103 bits |
| 20 | All four types (88) | 129 bits |
Example: a 16-character password using all four types has 8816, or about 1.3 × 1031, possibilities. Even at a trillion guesses per second, trying them all would take hundreds of billions of years.
Key facts
- A strong password is long (16+ characters), random and unique to one account.
- Entropy measures unpredictability; each extra bit doubles the number of guesses needed.
- This tool uses the browser's cryptographically secure random generator and keeps nothing.
Password tips
- Use a password manager to store unique passwords for every site, so you only remember one strong master password.
- Turn on two-factor authentication (2FA) for email, banking, UPI apps and exam portals.
- Never share passwords or OTPs by phone, SMS or chat. Banks and government portals do not ask for them.
- Change a password immediately if a site you use reports a data breach.
- For passwords you must type on a TV or phone keypad, turn off symbols and avoid look-alike characters, then add length to keep strength high.
Frequently asked questions
Is this password generator safe?
Yes. Passwords are created in your browser with crypto.getRandomValues, the browser's cryptographically secure random number generator, and are never sent over the internet or stored. Picking from the character set uses rejection sampling, so every character is equally likely.
How long should my password be?
Use at least 16 characters. CISA, the US cybersecurity agency, recommends passwords that are at least 16 characters long, random and unique for every account. Longer is stronger: each extra random character multiplies the number of possible passwords by the size of the character set.
How is password strength measured here?
Strength is shown as entropy in bits, calculated as length × log2(number of possible characters). A 16-character password drawn from all 88 characters has about 103 bits, which is far beyond what can be guessed by brute force.
Does every password include each character type I select?
Yes. The generator always places at least one character from each selected type (uppercase, lowercase, numbers, symbols), then shuffles the whole password securely, so sites that require a mix will accept it.
Should I use the same password everywhere?
No. Use a different password for every account, ideally saved in a password manager. If one site is breached, a reused password lets attackers into your other accounts.
Are generated passwords stored anywhere?
No. Generation happens entirely in your browser. Nothing is sent to any server or saved, so copy the password into your password manager before closing the page.