Password Generator
Make a random password from 4 to 128 characters, picking which letters, numbers and symbols it uses. It is generated in your browser with a secure random source and never sent anywhere.
Read the guide: How to Create a Strong Password You Do Not Have to RememberPassword settings
Quick presets
Generated password
Generated password will appear here...
Security tips
- Use passwords with at least 12 characters for better security
- Include a mix of uppercase, lowercase, numbers, and symbols
- Avoid using personal information in passwords
- Use unique passwords for each account
- Consider using a password manager to store passwords securely
- Change a password when a site reports a breach, not on a fixed schedule
How to create a strong password
- Set the length with the slider, anywhere from 4 to 128 characters. For an account password, start at 16.
- Choose the character types: uppercase, lowercase, numbers and symbols. If you will read the password out or type it by hand, exclude similar characters so i, l, 1, o, 0 and their look-alikes are left out.
- Click Generate password. A strength rating appears under the result.
- Copy it into your password manager or the sign-up form. Click Generate password again for a new one; nothing is kept once you leave. To test a password you already use, try Password Strength Checker.
Frequently asked questions
How long should a password be?
At least 15 characters when the password alone protects an account, and at least 8 when it is used with a second factor such as a code from an app or SMS. Those are the minimums in NIST's current guidance, SP 800-63B-4. A random 16-character password from this tool clears both.
Sources: NIST, SP 800-63B-4, section 3.1.1: passwords
Is a 12-character password strong enough?
A random one is hard to crack, but it is shorter than the 15 characters NIST now asks sites to require for a password used alone. With all four character types, 12 random characters give about 77 bits of randomness and 16 give about 103. Each extra character adds more than ticking another box does, so use 16 or more if the site allows it.
Sources: NIST, SP 800-63B-4, section 3.1.1: passwords
Is this password generator safe?
Yes. Passwords are made in your browser with crypto.getRandomValues, the browser's cryptographic random source, and they are never sent anywhere or stored. Every character is picked without bias, and the password always has at least one character of each type you tick.
Sources: MDN Web Docs, Crypto.getRandomValues()
Do I need symbols and numbers?
Not if the password is long and random. NIST tells sites not to force a mix of character types, because length does more. Some sites still demand a symbol or a digit, so leave those boxes ticked unless a site rejects certain symbols.
Sources: NIST, SP 800-63B-4, section 3.1.1: passwords
How often should I change my password?
Only when there is a reason, such as a breach at that site or signs that someone else has used your account. NIST tells sites not to force changes on a schedule, only when a password may have been exposed.
Sources: NIST, SP 800-63B-4, section 3.1.1: passwords
How do I remember a random password?
Let a password manager remember it. It stores and fills a different password for every site, so you only need to remember one strong master password, which can be a passphrase of several random words.