Generate cryptographically random passwords — 8 to 64 characters, with independent control of lowercase, uppercase, digits, symbols, and look-alike exclusion — using your browser’s own secure random source. Nothing is transmitted or saved.
How to generate a password
- Set the length — 16 is a strong default; go longer where sites allow it.
- Toggle character types. Every selected type is guaranteed to appear at least once, so a “must contain a symbol” form never rejects the result.
- Enable Avoid look-alikes if the password will be read or typed by a human (Wi-Fi setup, a printed recovery sheet) rather than pasted.
- Copy — or hit Regenerate until you get one you like. Each press is a fresh draw.
Why random beats clever
Human-invented passwords cluster: a capitalized word, a memorable number, a ! at the end.
Cracking software tries exactly those shapes first — dictionary words with common substitutions
and appended years fall in seconds, regardless of length. A random draw has no shape to
exploit, so an attacker’s only move is brute force through the whole space. That space grows
multiplicatively: each character from the full 94-symbol set adds about 6.6 bits of entropy,
and every ~10 bits multiplies the required guesses by a thousand. The meter under the output
shows this live — it is the same estimator as our
password strength checker.
One password per account — let software remember them
The strongest password in the world protects nothing if it also unlocks four other accounts: when any one site is breached, attackers replay the leaked password everywhere (“credential stuffing”). The workable system is a password manager — the one built into your browser or a dedicated app — holding a unique random password per site, protected by one long passphrase you actually memorize plus two-factor authentication. Generate here, store there, memorize almost nothing.
Private by design
Generation runs entirely on your device using the browser’s cryptographic random source. No password, setting, or keystroke is uploaded, logged, or stored — there is no server side to trust, and the network tab will show nothing leaving.