Secure Password Generator: Create Strong Random Passwords Online

Create strong and secure random passwords instantly with this free online password generator. Customize password length and character types to protect your online accounts.

Most people do not need a clever password. They need a long, random one that is different for every account, and a safe place to keep it. This free generator creates passwords locally in your browser using the Web Crypto API, rather than the weaker random function that many simple generators use, and it never sends, saves or logs what it creates.

Choose a length and the character types you want, press Generate, then copy the result into your password manager or the account's password field. Below the tool you will find worked examples, an explanation of how the passwords are made, and the limits you should know about.

Secure Password Generator

The password generator is loading. If this message does not disappear, JavaScript did not start on this page. See the troubleshooting note below the tool.

Troubleshooting: if you still see the "loading" message above, JavaScript did not start. Reload the page, make sure JavaScript is enabled, and try another browser. If you see a message saying secure random numbers are unavailable, the generator has switched itself off on purpose, and it will not fall back to a weaker method.

How to use the generator

1. Set the length. Type a number from 8 to 128 or move the slider. The default is 16 characters.
2. Choose character types. Lowercase, uppercase, numbers and symbols are all on by default. Turn off any type that the website you are signing up to does not accept.
3. Pick the extra options. "Include at least one character from each selected type" helps with sites that insist on a mix. "Avoid look-alike characters" removes I, l, 1, O and 0, which helps if you must type the password by hand.
4. Press Generate. A new password appears together with an estimate of its strength. Changing the length or an option also creates a new password straight away, so the password on screen always matches your settings.
5. Copy it. Press Copy password, paste it into your password manager or the account form, and save it. Use Hide if someone could see your screen.
6. Reset if needed. Reset settings restores the defaults and generates a new password.

Worked examples

Because every password is random, the exact characters will differ each time. What you can check is the length, the character pool and the estimated entropy, which are calculated from the formula explained below.

Example 1: the default settings

Settings: length 16, all four character types, "at least one of each" on, look-alikes allowed.
Result: 16 characters with at least one lowercase letter, one uppercase letter, one number and one symbol. The pool has 85 characters (26 + 26 + 10 + 23), so the estimate is 16 × log₂(85), about 102.6 bits, shown as "Very strong".

Example 2: letters and numbers only, easy to read

Settings: length 20, symbols off, "avoid look-alike characters" on.
Result: 20 characters from a pool of 57 (25 lowercase, 24 uppercase and 8 numbers). The estimate is about 116.7 bits, shown as "Very strong". This is a good choice for a site that rejects symbols. The extra length makes up for the smaller pool.

Example 3: a shorter password for a strict site

Settings: length 12, only lowercase letters and numbers.
Result: 12 characters from a pool of 36, about 62.0 bits, shown as "Good". If the site allows a longer password, increase the length instead of adding symbols.

Example 4: why numbers alone are weak

Settings: length 8, only numbers.
Result: a pool of 10 characters gives about 26.6 bits, shown as "Weak". Such a password is fine for a short-lived PIN that a service protects with lockouts, but not as the only protection for an account.

How the passwords are generated

• Secure randomness. Every random choice comes from crypto.getRandomValues(), the browser's cryptographically strong generator, described by MDN's documentation. The tool never uses Math.random(), which is not designed for security. If the browser cannot provide secure randomness, the tool switches itself off instead of falling back to a weaker method.
• No hidden bias. Picking a character with a simple remainder operation slightly favours some characters. The tool avoids this by discarding any random number that falls in the uneven leftover range and drawing again (rejection sampling).
• Required types without a fixed layout. When "at least one of each" is on, the tool first picks one character per selected type, fills the rest from the whole pool, and then shuffles everything with a secure Fisher-Yates shuffle. That way the required characters do not sit at predictable positions.
• Pattern check. A password is discarded and regenerated if it contains three identical characters in a row (such as "aaa") or a straight run of four consecutive characters (such as "abcd" or "4321"). Random passwords rarely do, and discarding them barely changes the odds. It simply avoids results that look predictable.
• Entropy estimate. Entropy in bits = length × log₂(size of the character pool). Each extra bit doubles the number of possibilities. The tool labels the result with a simple teaching scale: below 40 bits Weak, 40 to 59 Fair, 60 to 79 Good, 80 to 99 Strong, and 100 or more Very strong. This scale is a rough guide of my own, not an official standard.

Password strength depends on length, randomness and how the password is used. A long random password is only strong if it is unique to one account, kept safe and protected by the service with good practices.

Password managers and multi-factor authentication

A generator makes strong passwords, but you still have to store them somewhere. Writing 20 random characters on a note or reusing one for several sites defeats the purpose. CISA's guidance for everyday users is to use long, random, unique passwords with a password manager, and to turn on multifactor authentication (MFA) wherever it is offered. Most password managers include their own generator, which is often the most convenient choice, because it saves the result for you in one step.

NIST's SP 800-63B-4, published in July 2025, takes the same direction. Its guidance sets a minimum of 15 characters when a password is the only authentication factor and 8 when it is one factor among several, expects services to allow at least 64 characters, to allow pasting and password managers, and to avoid forcing mixed character types. So if a site lets you choose, prefer a longer password over a complicated short one.

Limitations and common mistakes

• Reusing a generated password. One random password per account. If one site leaks it, a reused password exposes your other accounts.
• Trusting the estimate too much. The entropy figure assumes the password is random and used nowhere else. It does not know whether a service stores it safely or whether it has already leaked.
• Unsafe devices. No generator can protect a password from malware, a keylogger or a hijacked clipboard. Browser extensions that can read page content can also see what is on a page, so be selective about which extensions you install. Our guide to Chrome extension permission warnings explains what to check.
• The clipboard. Copied text can stay in the clipboard, and some systems keep a clipboard history. Paste the password where you need it, then copy something harmless over it.
• Site rules. Some sites cap the length or reject certain symbols. If a symbol is rejected, turn symbols off and raise the length.
• Not a password manager. This page does not remember anything. Close it and the password is gone from the tool, so save it first.
• Trust in the page. You are running code that this page loads. For the highest assurance, use your password manager's built-in generator. Like any page on this site, this page may load ads or analytics described in our Privacy Policy, but the tool itself does not transmit or save what you generate.

Frequently asked questions

Is it safe to use an online password generator?

It depends on who runs it and how it works. This one creates passwords locally with your browser's secure random generator and does not send them anywhere. Even so, a generator on a web page is a convenience. If you already use a password manager, its built-in generator is usually the better choice.

Does this tool store or send my passwords?

No. The password is created in your browser, shown on screen, and removed when you close or reload the page. The tool does not save it, log it or transmit it. Your browser or clipboard manager may keep what you copy.

How long should my password be?

The default of 16 characters is a sensible starting point for a random password. NIST's guidance sets 15 characters as the minimum when a password is the only factor. Use more if the site allows it, especially for email, banking and your password manager.

Why doesn't the tool use Math.random()?

Math.random() is not designed for security, so its output should not be used for passwords. The tool uses crypto.getRandomValues() instead, and stops working if the browser cannot provide it.

What does the entropy number mean?

It estimates how many possible passwords an attacker would have to search through if they knew your length and character types, measured in bits. It is a rough guide to randomness, not a guarantee of safety.

Do I still need MFA if my password is strong?

Yes. A strong password does not help if it is phished or leaked. CISA recommends using multifactor authentication on every account that offers it.

Conclusion

A good password is long, random and unique, and it lives in a password manager with MFA turned on. Use the generator above to create it locally, copy it once, and do not reuse it. To protect your PC as well, read about installing Windows software safely and what to do about a Chrome unsafe extension warning.