Free Secure Password Generator
Create a strong random password or an easy-to-type passphrase in one click, using your browser's secure random source.
Created on your device. Never sent or saved.
How to use a generated password
Open the account's password page
Go directly to the site's change-password page, or the sign-up form for a new account.
Copy it straight in
Copy the result here and paste it in. Don't email it to yourself or leave it in a note.
Save it in your manager
Let your password manager store and fill it. Then make a new one for the next account.
Random password or passphrase?
Both are strong when they're truly random and long enough. Choose by how you'll use it.
Random password
Best for accounts your password manager fills in, because you never need to read or type it.
e7$Kq!9mZ2@xVt4#pL6wPassphrase
Best when you must type it yourself, like your manager's master password or your computer login.
tinker-skinning-tribute-kennel-velvet-dillExamples only. Never use a password published on a web page.
How much is enough?
These figures use the same calculation as the tool, and assume the result was generated randomly. A password you invented yourself won't be this strong.
| Setting | Strength | Bits of randomness | Fast offline attack |
|---|---|---|---|
| 12 random characters | Strong | About 77 | Centuries or more |
| 16 random characters | Very strong | About 103 | Centuries or more |
| 20 random characters | Very strong | About 128 | Centuries or more |
| 4 random words | Fair | About 52 | 2 days |
| 5 random words | Strong | About 65 | 45 years |
| 6 random words | Strong | About 78 | Centuries or more |
| 8 random words | Very strong | About 103 | Centuries or more |
NIST's guideline requires at least 15 characters for a password used on its own, so shorter passwords can't reach “Very strong” here.
Already have a password?
See how it holds up, and exactly what makes it weak.
How it creates passwords
- Secure randomness. It uses your browser's Crypto.getRandomValues, not the ordinary random function, which isn't meant for security.
- No shortcuts. Every allowed result is equally likely. If a character type you chose is missing, we redraw the whole password rather than patching it.
- Nothing kept. There's no history, account, or saved setting. Generating another replaces the last one.
What a strong password can't do
- Stop phishing. Even a perfect password can be typed into a fake site. Password managers help, because they won't fill it on the wrong address.
- Survive reuse. Use each one for a single account, so one breach can't spread. Gaming accounts are a common target for this.
- Replace a second step. Turn on two-step sign-in wherever you can.
Password generator questions
Are generated passwords stored anywhere?
No. Each one is created in your browser and isn't saved or sent. This page also tells your browser to block its scripts from opening network connections, and it no longer keeps a list of recent passwords. Once you leave the page, it's gone, so save it in your password manager first.
Is it safe to use an online password generator?
This one does the work on your device, using your browser's secure random source. If you'd rather not rely on any website, your password manager almost certainly has a generator built in, and that's a great choice too.
Do I need a password manager to use these?
It's strongly recommended. Long random passwords are only practical if something remembers them for you, and a manager also stops you reusing the same password across sites.
How long should my password be?
We suggest at least 16 random characters, or six random words. NIST's current guideline sets 15 characters as the minimum for a password used on its own.
What if a site rejects my password?
Some sites limit length or don't allow certain symbols. Shorten it, turn off symbols, or enter only the symbols the site allows under More options, then generate another. Keep it as long as the site permits.
Should I use a passphrase or a password?
Use a random password for anything your password manager fills in. Use a passphrase when you need to type it yourself, such as your manager's master password or your computer login.