How long should a strong password be?

At least 16 characters when it mixes letters, digits and symbols, which gives about 100 bits of entropy. For accounts that matter most, 20 or more costs nothing if a password manager stores it.

Are these passwords really random?

Yes. Each character is drawn with crypto.getRandomValues, the browser's cryptographic random number generator, using rejection sampling so no character is more likely than another.

Is it safe to generate passwords online?

This generator runs entirely in your browser. The passwords are created on your device and are never sent to a server, logged or stored.

Why does the password always contain every type I selected?

Many sites require at least one digit or symbol, so the generator places one character from each selected type, fills the rest from all of them, and shuffles the result.

Password Generator

Strong random passwords with the strength shown in bits. Everything runs locally with zero file uploads.

In: Length · character types
Out: Passwords

Signing tokens rather than logging in? Use the JWT Secret Generator

Random beats clever

People are bad at picking passwords: we reuse them, build them from words and dates, and swap letters for look-alike digits in ways cracking tools already expect. A password drawn at random from a large set of characters has none of those patterns, so the only way to find it is to try every possibility.

How strength is measured

Strength is shown in bits of entropy: the length multiplied by log₂ of the number of characters it can be drawn from. Every extra bit doubles the guesses an attacker needs. Under 50 bits is weak, 80 bits holds up against offline cracking, and above 120 bits is beyond any foreseeable attack.

Good habits

Length matters most. Each extra character multiplies the work; going from 12 to 20 characters does far more than adding symbols.
One password per site. When one site leaks, a reused password opens every other account that shares it.
Let a password manager remember them. Then length costs you nothing, because you never have to type it.
Avoid look-alikes when a password has to be read aloud or typed from paper: it leaves out I, l, 1, O, 0 and o.

Frequently asked questions

How long should a strong password be?: At least 16 characters when it mixes letters, digits and symbols, which gives about 100 bits of entropy. For accounts that matter most, 20 or more costs nothing if a password manager stores it.
Are these passwords really random?: Yes. Each character is drawn with crypto.getRandomValues, the browser's cryptographic random number generator, using rejection sampling so no character is more likely than another.
Is it safe to generate passwords online?: This generator runs entirely in your browser. The passwords are created on your device and are never sent to a server, logged or stored.
Why does the password always contain every type I selected?: Many sites require at least one digit or symbol, so the generator places one character from each selected type, fills the rest from all of them, and shuffles the result.

The other tools

Data StudioMove structured text between JSON, YAML, TOML, CSV and Markdown.JWT Secret GeneratorRandom HS256, HS384 and HS512 secret keys in hex or Base64, ready for your .env.JWT DecoderRead a token's header and claims, check its expiry and verify its signature.Mock Data GeneratorRealistic fake users, products and orders with your own columns, as JSON, CSV or SQL.Image ConverterRe-encode, resize and vectorise images with a live before/after.Compress & ArchiveShrink any file with gzip or Brotli, or bundle a folder into ZIP.DOCX to PDFTurn a Word document into a PDF with real, selectable text.PDF to DOCXRecover an editable Word document from a PDF's text layer.Background RemoverAutomatic AI cutout, macOS-style smart selection, and precision manual tools.PDF EditorSign documents, edit text, insert images, and whiteout PDFs directly in your browser.Case ConverterTurn text into kebab-case, camelCase, snake_case, Title Case and ten more cases.Lorem Ipsum GeneratorPlaceholder text by paragraphs, sentences or words, as plain text or HTML.Image to ASCIITurn a photo into ASCII art, in black and white or full colour.