Strong Password Generator

What makes a password hard to guess?

A useful password is unpredictable, long enough for its purpose, and unique to one account. Names, dates, and keyboard patterns can appear in guessing lists even when they look personal. This tool does not build passwords from familiar words or personal details: it draws characters from your selected pool using secure randomness. A password alone cannot guarantee protection against every account attack.

Length does more than a familiar substitution

Adding genuinely random characters increases the number of possible combinations. Uppercase letters, lowercase letters, digits, and symbols expand the available pool. Replacing a letter in a short familiar word with a symbol is a different process and can remain predictable. The default here is 20 characters, with a range of 8–128 for compatibility with different services. The lower limit is an available setting, not a claim that eight characters is suitable for every account.

Generate a password that the service accepts

Check the destination service’s length and symbol rules, select your groups, then press Generate password / Generate again. Each selected group appears at least once in the result. Exclude lookalike characters removes I, l, 1, O, 0, o, and | from the pool, which can help when typing manually but reduces the pool slightly. Changing a setting clears the old result. Copy the generated password and save it in your password manager before leaving this page.

Why reuse turns one breach into several

Attackers can try a password exposed by one service on other sites. Reusing it for shopping, email, and social accounts creates a connection between otherwise separate accounts. Changing only a final digit or adding a site name creates a pattern that may also be guessed. Generate an independent password for each account to reduce the impact of a leaked credential.

Use a password manager and a second factor

A password manager helps you keep a different, long password for every service without memorizing them all. Protect its master password and recovery method. Enable multi-factor authentication (MFA) where available so a stolen password is not the only barrier to account access. Keep checking the domain of sign-in pages: a convincing imitation can still trick someone into disclosing a password or verification code.

How this generator obtains randomness

crypto.getRandomValues() uses the browser’s cryptographic random source. General-purpose Math.random() does not provide the security properties required here. To map random integers to characters fairly, the generator rejects the incomplete tail of the integer range rather than introducing modulo bias. It also retries candidates that omit a selected character group. If secure randomness is unavailable, generation stops instead of falling back to a weaker method.

Where the result exists, and how to handle it

The generation module does not put the password in server requests, analytics events, console messages, URLs, localStorage, or sessionStorage. While the page is open, the result exists in browser memory and the output field. Clear and leaving the page empty the field; this is not a forensic memory-erasure guarantee. Copy writes to your device clipboard only when you request it, and clipboard history or synchronization may retain a copy. Avoid sending passwords through email or chat. If sharing is necessary, consider a password manager’s controlled sharing feature. Existing page advertising and permitted analytics resources can operate separately from password generation.

Frequently Asked Questions