Password Generator

Length matters more than complexity once you're past a basic minimum. A 20-character password using only lowercase letters is harder to crack than an 8-character password crammed with symbols, because each extra character multiplies the number of guesses an attacker has to try. Mixing in uppercase, numbers, and symbols still helps — it just matters less than making the password longer.

No. Every password is generated directly in your browser using the Web Crypto API and only ever exists in your browser's memory. Nothing is transmitted to a server, stored, or logged — closing or refreshing the page erases it completely.

It uses crypto.getRandomValues(), the browser's cryptographically secure random number generator, not Math.random(). Math.random() is not designed for security-sensitive use and can be predictable; crypto.getRandomValues() is the same class of randomness used for cryptographic keys, which makes it suitable for generating passwords.

This tool lets you toggle uppercase letters, lowercase letters, numbers, and symbols. Each character type you add increases the pool of possible characters at every position, which increases the total number of possible passwords an attacker would have to search through. For maximum strength, enable all four types and use as much length as the site you're signing up for allows.

16 characters or more is a solid baseline for important accounts like email and banking; 12 is a reasonable floor for everything else. Since a random 16+ character password isn't meant to be memorized, store it in a password manager rather than trying to remember it, and generate a unique password for every site — reusing passwords means one breached site can compromise all your other accounts.