Password Generator

How to use it

1. 1Choose password for something going into a password manager, or passphrase for something you will type by hand.
2. 2Drag the length slider — sixteen characters or more is comfortably beyond brute force.
3. 3Toggle the character sets you need. Some sites reject symbols, which is the main reason to turn any off.
4. 4Turn on "leave out look-alikes" only if you will read the password off a screen, since it costs entropy.
5. 5Copy it straight into your password manager, then press generate again so the value on screen is not the one you kept.

Frequently asked questions

Are these passwords sent anywhere?

No. Generation happens in your browser using its built-in cryptographic randomness, with no network request involved. Closing the page discards the value entirely.

Is a passphrase as strong as a random password?

It can be, given enough words. Five words carry about thirty-nine bits, weaker than sixteen random characters, but far easier to type and remember — the right trade for a password you cannot store in a manager.

Should I change my passwords regularly?

Modern guidance says no, not on a schedule. NIST recommends changing a password only on evidence of compromise, because forced rotation pushes people towards small predictable edits.

Related tools

• SHA Hash GeneratorGenerate SHA-256, SHA-384, SHA-512 or SHA-1 hashes of any text in your browser, using the Web Crypto API. Nothing is uploaded.
• UUID GeneratorGenerate UUID v4 or the time-ordered v7 in bulk, using your browser's cryptographic randomness. Also validates and inspects existing UUIDs.
• JWT DecoderDecode a JSON Web Token in your browser and read its header, payload and claims. Expiry is checked against your clock. Nothing is ever uploaded.