Password Generator
Generate strong random passwords and memorable passphrases - crypto-secure, 100% in your browser.
How this calculator works
Human brains are terrible at randomness, and attackers know it. We pick pet names, birthdays, and keyboard walks like qwerty123, then bolt on a single exclamation mark and call it secure. Password-cracking tools try exactly these patterns first, which is why a clever-to-you password like "Sunshine2024!" falls in seconds while a truly random 20-character password would take longer than the age of the universe to guess. Randomness is the whole game: every extra character multiplies the guessing work, and with 20 characters drawn from upper, lower, digits and symbols you get about 129 bits of entropy. The catch used to be memorization, but you do not need to memorize random passwords at all. That is your password manager's job.
Entropy is the honest way to compare password strength, and it is simpler than it sounds: each bit doubles the number of guesses an attacker needs. A 12-character random password from the full character set has around 78 bits, a 16-character one around 104, and 20 characters around 129. Passphrases play the same game with words instead of characters: four random words from a 900-word list give about 39 bits, which shrugs off online guessing attacks, while six to eight words land around 59 to 78 bits for accounts that really matter. The strength meter above shows this number live as you change options, so you can see exactly what extra length or an extra word buys you. Either style beats any password a human invents, because humans repeat patterns and random draws do not.
The practical setup is boring on purpose: a password manager (there are good free ones) holding a unique random password for every site, plus two-factor authentication on the accounts that matter most, email, banking, and anything tied to money. Reuse is the real killer. One breached forum password should never open your inbox. As for this generator, everything happens locally in your browser with crypto.getRandomValues, the same cryptographically secure random source browsers themselves use for security features. Your passwords are never sent to a server, never logged, and never stored. You can even disconnect from the internet and keep generating. Copy the result straight into your password manager and close the tab.