Generate a strong random password
—This tool generates random passwords using the Web Crypto API's cryptographically secure random number generator (crypto.getRandomValues) — not Math.random(), which isn't safe for security purposes. Choose a length and which character types to include, and a new password is generated instantly. Nothing is sent anywhere or stored.
Why the randomness source matters
Many online password generators use Math.random(), which is not cryptographically secure — its output is predictable from previous values if you know the algorithm and seed. For a password protecting anything real, that is a genuine weakness rather than a theoretical one. This tool uses the Web Crypto API's getRandomValues, the same source browsers use for cryptographic operations, which is designed to be unpredictable.
Length beats complexity
A longer password made of simple characters is generally stronger than a shorter one stuffed with symbols, because each additional character multiplies the search space. Sixteen characters of mixed letters and digits is substantially stronger than eight characters with symbols, and far easier to handle if you ever need to type it manually. Symbol requirements exist mainly because some systems mandate them, not because they are the most efficient path to strength.
Use a password manager
A generated password is only useful if you never reuse it, which in practice means you cannot memorise it. Generate directly into a password manager, let it store the value, and never see the password again. The main real-world risk to most accounts is not weak passwords but reused ones — a single breach elsewhere then unlocks everything. Nothing generated here is stored or transmitted; refreshing the page loses it permanently.
Frequently asked questions
- Why does this matter vs. a simple random password generator?
- Many online generators use Math.random(), which is not cryptographically secure and can be predictable. This tool uses the Web Crypto API, the same source browsers use for cryptographic operations.
- Is the password stored or sent anywhere?
- No, generation happens entirely in your browser. Nothing is transmitted or saved — refreshing the page loses it.
- What's a good password length?
- 16 characters or more with mixed character types is a reasonable default for most accounts; use longer for high-value accounts.
- Is the generated password sent anywhere?
- No. Generation happens entirely in your browser and the value is never transmitted or saved. Closing the page loses it.
- What length should I use?
- Sixteen characters or more for ordinary accounts, longer for email and banking since those can be used to reset everything else.