How this password generator works
This tool generates passwords locally in your browser using crypto.getRandomValues(), the Web Crypto API's cryptographically secure pseudo-random number generator (CSPRNG). Nothing you generate here is transmitted over the network, logged, or stored anywhere — closing this tab is enough to guarantee the password existed only on your machine.
What makes a password strong?
Strength is a function of entropy: how many possible passwords could have been generated with the same settings. A 20-character password using upper/lowercase, numbers and symbols has roughly 130 bits of entropy — effectively unbreakable by brute force with current computing power. Length matters more than complexity: a 20-character lowercase-only password is often stronger than an 8-character password with every character class enabled.
Recommendations
- Use at least 16 characters for any account that matters.
- Use a unique password per site — a password manager (not memorization) is the only realistic way to do this at scale.
- Enable "exclude ambiguous characters" only if you need to transcribe the password by hand; otherwise leave it off to maximize the character pool.
Already have a password instead of generating a new one, and want to know how strong it actually is? See Password Entropy Calculator — it also checks for common weak patterns a raw entropy number alone would miss.