How to use the Password Generator tool
- Set the length. 16 or more characters is recommended.
- Choose the character types: capitals, lowercase, digits and symbols.
- Click “New” for another password and “Copy” to use it.
What makes a password strong?
Length matters more than complexity. Every extra character multiplies the number of possible combinations. A random 16-character password with letters, digits and symbols has over 100 bits of entropy, far beyond what can be guessed by brute force. The strength indicator shows the entropy of your current settings.
- Under 50 bits: weak, can be cracked quickly.
- 50 to 80 bits: good for most accounts.
- 80 to 110 bits: strong.
- Over 110 bits: very strong, suitable for master passwords and encryption keys.
Use a different password for every site
Most account takeovers happen because people reuse passwords that leaked from another website. Generate a unique password for each account and store them in a password manager such as Bitwarden, 1Password or the one built into your browser. Turn on two-factor authentication wherever possible.
How the passwords are generated
The tool uses crypto.getRandomValues, the cryptographically secure random generator built into your browser, with rejection sampling so every character is equally likely. Each password includes at least one character from every type you select. Everything you type stays in your browser. Nothing is sent to a server or stored.
Frequently asked questions
Are the passwords stored anywhere?
No. They are created in your browser and disappear when you leave the page.
How long should my password be?
At least 12 characters for normal accounts, 16 or more for email, banking and password managers.
What are look-alike characters?
Characters such as 0 and O or l and 1 that are easy to confuse when you type a password by hand.
Is a random password better than a passphrase?
Both are secure if long enough. Random passwords are best in a password manager; passphrases are easier to type from memory.