Generate secure, random passwords instantly. Nothing is stored or sent anywhere.
Copied to clipboard!
Drag the length slider. We recommend at least 16 characters for strong security on important accounts.
Select which character types to include: uppercase, lowercase, numbers, and symbols. More types = stronger password.
The strength bar shows how secure your password is. Aim for "Strong" or "Very Strong" for important accounts.
Click Copy, then paste it into your account. Store it in a password manager — never reuse passwords across sites.
At least 12 characters for general accounts and 16+ for critical accounts like email, banking, and work systems. Every additional character exponentially increases security.
No. Password generation happens entirely in your browser using JavaScript. Nothing is sent to any server — your passwords are 100% private and never logged.
Length, variety, and randomness. Use 16+ characters with uppercase, lowercase, numbers, and symbols. Never use dictionary words, names, dates, phone numbers, or keyboard patterns like "qwerty".
Yes, always. If one site is breached, your other accounts stay safe. Use a password manager like Bitwarden (free and open source) or 1Password to store unique passwords for every account.
Including symbols expands the character set from ~62 to ~95 possible characters per position, making brute-force attacks vastly harder. A 16-character password with all types has trillions of possible combinations.
Yes. Uncheck all options except Numbers and set your desired length. You will get a random numeric PIN. Note: numeric-only passwords are weaker — only use them for low-risk applications like device lock screens.
Change immediately if a site is breached. Current NIST guidelines do not require routine changes for strong, unique passwords — focus instead on using a password manager and enabling two-factor authentication (2FA).
Password strength is measured in "entropy" — bits of randomness. Each additional character roughly doubles the search space an attacker must brute-force. With modern GPUs cracking ~100 billion passwords per second, the math matters:
Cracked in under 1 second. Avoid completely. Even with mixed case + numbers + symbols, 8 characters is no longer safe in 2026.
Approximately 78 bits of entropy. Would take ~200 years to crack with current hardware. Acceptable minimum for most accounts.
~105 bits of entropy. Effectively uncrackable with current technology — would take longer than the age of the universe even with all GPUs on Earth running in parallel.
Recommended for password manager master passwords, encryption keys, and high-value accounts. ~130+ bits is post-quantum safe for the foreseeable future.
Not every account needs a 20-character random password. Use this tiered approach:
Tier 1 — Critical accounts (use 20+ char): Email (primary), password manager master, banking, cryptocurrency exchanges, work SSO, domain registrar, GitHub/code repos. A compromise here can cascade to dozens of other accounts.
Tier 2 — Important accounts (16+ char): Social media (Twitter, LinkedIn, Facebook), cloud storage (Dropbox, iCloud), shopping accounts with saved payment, work tools (Slack, Notion), AWS/cloud consoles.
Tier 3 — Standard accounts (12+ char): Newsletters, forums, low-value SaaS trials, account creation just to read content. These are also the accounts most likely to suffer breaches.
The non-negotiable: never reuse passwords across tiers. A breach at a Tier 3 site (which happens constantly) should never expose your Tier 1 accounts.
Birthdays, pet names, partner names, addresses, phone numbers — all easily found via social media or data brokers. Attackers run "credential stuffing" attacks using common personal-info patterns.
Replacing letters with symbols (a→@, o→0, e→3) used to feel clever — but every password cracker has these substitutions built into their dictionaries. The strength gain is essentially zero.
Browser-saved passwords are convenient but accessible to anyone with physical access to your unlocked device. Use a dedicated password manager with master-password encryption.
Email and SMS aren't encrypted end-to-end and persist in logs. If you must share a password, use a one-time-secret tool that destroys the link after viewing, or share via your password manager's secure sharing feature.
Even a perfect password can be phished. Two-factor authentication (preferably TOTP via Authy/Google Authenticator, not SMS) is the single biggest security upgrade you can make.