Strong password generator.
Create a strong random password in one click. Choose the length and the kinds of characters, and generate up to 10 at once. The passwords are made by your browser's secure random generator, on your own device, and are never sent to us or stored anywhere.
- Free, no sign-up
- Runs in your browser. Nothing you enter is sent to us.
Your password
How to use the password Generator
- Set the length. 16 characters or more is a good choice.
- Choose which characters to include.
- Copy a password, or press Generate for new ones.
- Save it in a password manager, and turn on two-step verification.
What makes a password strong
Length and true randomness. Each extra character multiplies the number of guesses needed, so a long password beats a short one full of symbols. Names, dates, phone numbers and swaps like P@ssw0rd are the first things attackers try. NIST's guidance now favours length over forced complexity, and recommends at least 15 characters when a password is the only thing protecting an account.
Three habits that matter more than any one password
- Use a different password for every account. When one site is hacked, attackers try the same login everywhere else.
- Use a password manager, so you only need to remember one strong password.
- Turn on two-step verification wherever you can, especially for email, banking, hosting and your website's admin login.
For your business website
Hacked small-business sites are often broken into through weak or reused admin passwords and out-of-date plugins. Give each person their own login instead of sharing one, and remove people who've left. Then run the website security checker to see how your site is set up, and the SPF, DKIM and DMARC checker to make it harder for anyone to send email pretending to be you.
About the password Generator.
Can you see the passwords I generate?
No. They are created in your browser using its built-in secure random generator, and they are never sent to our server or saved.
How long should a password be?
At least 15 characters when nothing else protects the account. We suggest 16 or more, and 20 for important accounts if you use a password manager.
What does the strength estimate mean?
It measures how many possibilities an attacker would have to try, in bits. Each extra bit doubles that number. It applies to randomly generated passwords like these, not ones you make up.
What does excluding similar characters do?
It leaves out characters that are easily confused, like l, 1, I, O and 0. That is useful for a password you must read or type by hand. It makes the password very slightly weaker for the same length.
Should I change my passwords regularly?
Current guidance says only when there is a reason to, such as a data breach. A long, unique password can stay in place.
You might also need these.
Website Security Checker
Grade a site's security headers, HTTPS, SSL, cookies and mixed content, with fixes for each.
Use the toolBase64 Encoder & Decoder
Encode and decode Base64 text, including Urdu and emoji, or turn an image or file into a data URI.
Use the toolSPF, DKIM & DMARC Checker
Check a domain's email authentication records, and generate a DMARC record to fix what's missing.
Use the toolWant this done for you?
Free tools show you what to fix. We fix it, measure it, and keep it working while you run the business.