Security Generators
Password, token, hash generators — 1 free tool in our Generators category.
The tool
Security generators produce values whose whole purpose is being unpredictable, which makes the source of randomness the thing that matters.
Randomness has to be cryptographic
The Password Generator draws from your browser's crypto.getRandomValues, a cryptographically secure source. This is not a detail: Math.random() is a fast pseudo-random generator that is fine for shuffling a carousel and unfit for anything secret, because its output can be predicted from previous values. Any password tool built on it is generating guessable passwords.
Length beats complexity
This is the most useful thing to know about passwords. Entropy grows with length far faster than with character variety, so a 16-character password of only lowercase letters is stronger than an 8-character password using every symbol on the keyboard. Aim for 16 characters or more and stop worrying about whether you have included an exclamation mark.
The rules many sites still enforce — one uppercase, one digit, one symbol, change every 90 days — are no longer recommended practice. NIST's current guidance favours length, screening against known-breached password lists, and not forcing periodic rotation, because rotation drives people towards predictable variations like Password1, Password2.
Reuse is the real risk
Most account compromises are not cracked passwords, they are credentials reused from a site that was breached. A unique password per account contains the damage, and remembering dozens of unique 16-character strings is only practical with a password manager — which is the actual recommendation. Generate, store, and memorise one strong master passphrase.
Passwords generated here are produced locally and never transmitted.
Frequently Asked Questions
How long should a password be?▼
At least 16 characters for important accounts. Length contributes more entropy than character variety, so a long passphrase of ordinary words is both stronger and easier to type than a short string of symbols.
Should I change my passwords regularly?▼
Not on a schedule, according to current NIST guidance. Forced rotation pushes people towards predictable increments. Change a password when there is a reason to — a breach notification, a shared credential, or any suspicion of compromise.
Are generated passwords sent anywhere?▼
No. Generation happens entirely in your browser using its built-in cryptographic randomness, and nothing is transmitted or stored. Closing the tab discards the value, so save it to your password manager first.