Is this password generator safe to use?

Yes. Passwords are created on your device and never sent anywhere or stored. You can disconnect from the internet after the page loads and it keeps working.

How long should a password be?

For accounts protected by a password manager, 16–20 random characters is plenty. For a master password you have to remember, a long passphrase of several random words works better.

What does bits of entropy mean?

It's how many guesses an attacker would need, as a power of two. Each extra bit doubles the work, so 80 bits is a million times harder to guess than 60 bits.

Free developer tool

Strong Password Generator

Generate strong random passwords in your browser with the Web Crypto API, with entropy and time-to-crack estimates.

Generating…

Strength: very strong

130 bits of entropy

At 10 billion guesses per second (a fast offline attack on a leaked, weakly hashed password list), guessing it would take longer than the age of the universe, many times over on average.

Truly random passwords

Passwords are generated in your browser with crypto.getRandomValues, the same cryptographically secure random source browsers use for encryption keys. Characters are picked with rejection sampling, so every character in the pool is exactly as likely as any other.

Strength is measured as entropy: length × log2(number of possible characters). A 20-character password from all four sets has about 131 bits, far beyond what any attacker can guess. The time-to-crack figure assumes 10 billion guesses per second, a realistic offline attack on a leaked password database.

Tips

Use a different password for every site, and keep them in a password manager.
Length beats complexity: 16 or more characters is a good minimum.
Turn on Avoid look-alikes if you'll ever have to type the password by hand.
Turn on two-factor authentication wherever it's offered.

Frequently asked questions

Is this password generator safe to use?: Yes. Passwords are created on your device and never sent anywhere or stored. You can disconnect from the internet after the page loads and it keeps working.
How long should a password be?: For accounts protected by a password manager, 16–20 random characters is plenty. For a master password you have to remember, a long passphrase of several random words works better.
What does bits of entropy mean?: It's how many guesses an attacker would need, as a power of two. Each extra bit doubles the work, so 80 bits is a million times harder to guess than 60 bits.