Secure Password Creator
Free Random Password Generator
Passwords are generated instantly in your browser and are never sent to a server. Choose the length and character types, then copy with one click.
Password Problems and Fixes
A strong password isn't enough: it also has to be accepted by the system, typed correctly and never reused elsewhere. Pick your situation.
The site won't accept my password
Some systems reject symbols such as quotes, backslashes or < >, or anything over a certain length. Turn on "Only widely accepted symbols", and if the site has a length limit (say, 16 at most) set the slider to it. Every character type you select appears at least once, so rules like "at least one digit" are met.
Create PasswordI mix up characters when typing the password by hand
In Wi-Fi passwords or ones typed on a TV or phone, capital I, lowercase l, the digit 1, and O and 0 are easy to confuse. Turn on "Leave out look-alike characters" and add a few characters of length to keep the strength.
Create PasswordA site I use had a data breach
Change your password on that site and everywhere you used the same one, right away: attackers automatically try leaked passwords on other sites. Generate a separate password for each account and turn on two-step verification.
I use the same password everywhere
One breach opens every account. Generate a separate password for each one; if you're setting up many accounts, bulk generation creates up to 50 at once. Keep them in a password manager.
I can't remember strong passwords
You don't need to memorise random passwords: a password manager stores and fills them for you. For the one master password you do need to remember, choose a long passphrase made of several unrelated words.
My email account was hacked
Change the password straight away, sign out all sessions, turn on two-step verification and check for forwarding rules added to the account. Also stop spoofed email using your domain with a DMARC policy.
DMARC Record CheckerWhat Makes a Strong Password?
A strong password is long and random enough that it can't be guessed. Length matters most: a random 16-character password is billions of times harder to guess than an 8-character one that merely looks complicated.
This tool generates the password with your browser's Web Crypto API; it is never sent to a server or stored. Every character type you select appears in the password at least once.
- LengthHas the biggest effect
- Character poolAll selected types together
- Estimated entropyHow hard to guess, in bits
How to Read Password Strength
16Length: The number of characters. Each extra character multiplies the possibilities to guess by the size of the pool.88Character pool: How many different characters the selected types contain; 88 with all four. Leaving out look-alikes makes the pool slightly smaller.103 bitEstimated entropy: length × log₂(pool). Over 80 bits counts as strong, over 100 bits as very strong.■■■■□Strength level: Five levels from very weak to very strong, based on entropy and length; keep important accounts at "strong" or better.
The meter is recalculated with every setting you change; adding length raises the strength more than adding character types.
Which Password for Which Account?
Recommended length and options depending on where the password will be used.
| Where it's used | Recommended setting |
|---|---|
| Email, banking, domain and hosting panels | 20+ characters, all four character types |
| Wi-Fi, or passwords typed by hand on a TV or phone | 20+ characters, look-alike characters left out |
| Older systems and apps that reject symbols | 16+ characters, only widely accepted symbols |
| Database, FTP and server accounts | 32+ characters, widely accepted symbols (no trouble in scripts or connection strings) |
| Many new accounts for a team | Bulk generation: 2–50 passwords at once, one per account |
Frequently Asked Questions
About password security, length and how this tool works.
-
Passwords are created only in your browser; they are never sent to a server or stored. Randomness comes from your browser's Web Crypto API, a cryptographically secure random number generator. Account security doesn't depend on the password alone: use a different password for every account and turn on two-step verification where possible.
-
We recommend at least 16 characters. NIST SP 800-63B-4 specifies at least 15 characters for accounts protected by a password alone. For important accounts such as email, banking or admin panels, you can choose 20 characters or more. Also check the rules of the site where you will use the password.
-
It lets you create different passwords for several accounts at once. It's handy when setting up a new system, creating staff accounts or preparing test environments. Up to 50 passwords can be generated.
-
Some older systems don't accept certain symbols (
! @ # $ %). If you run into problems, turn off the "Symbols" option and try upper/lowercase letters and numbers only. If you turn symbols off, we recommend increasing the length a little to keep the same level of security. -
Entropy measures, in bits, how unpredictable a password is. The tool's "estimated entropy" is an approximate value calculated from the selected length and character pool; it doesn't guarantee account security or cracking time. The strength meter considers length as well as estimated entropy: "Strong" requires at least 80 bits and 16 characters, "Very Strong" at least 100 bits and 20 characters. These thresholds are our tool's own assessment and apply only to passwords generated by this tool. For example, a 16-character password using all four character types has an estimated entropy of about 103 bits.
Protect Your Digital Identity, Starting with Your Password
A strong password is the first step. Strengthen your email security too, with SPF, DKIM and DMARC records on your business email.