Generate strong random passwords locally in your browser — nothing is ever uploaded or stored on any server.
How secure a password is comes down to its "entropy" — roughly, how many guesses an attacker needs on average to stumble onto it by brute force. Entropy is calculated as: bits per character in the character set × password length. Using only lowercase letters (26 characters) gives about log₂(26) ≈ 4.7 bits per character; turning on uppercase, lowercase, numbers, and symbols (roughly 94 available characters) gives about log₂(94) ≈ 6.55 bits per character. So a 16-character password using only lowercase letters has about 4.7 × 16 ≈ 75 bits of entropy, while the same 16 characters with all four character types enabled jumps to roughly 6.55 × 16 ≈ 105 bits. That gap is huge, because entropy scales exponentially — each additional character type multiplies the number of possible combinations rather than just adding to it.
A lot of people think turning "password" into "P@ssw0rd" makes it secure — this is a widespread misunderstanding. That kind of letter substitution (leetspeak: a→@, o→0, s→$) is a standard rule baked into every password-cracking dictionary. Cracking tools like Hashcat or John the Ripper already apply these substitutions automatically, so "P@ssw0rd" is barely harder to crack than "password" itself — it's still fundamentally a dictionary word with a few predictable flourishes on top. What actually raises entropy is randomness, not decoration: fully random characters (exactly what this tool produces via crypto.getRandomValues), or a string of several unrelated random words (the "correct-horse-battery-staple" approach), genuinely multiply the number of guesses an attacker needs.
Both matter, but length usually gives a better return. Expanding the character set from 26 to 94 options only raises entropy per character from 4.7 to 6.55 bits (roughly a 40% gain), whereas going from an 8-character to a 16-character password doubles the total entropy outright. If you can only optimize one thing, prioritize length; character variety is the bonus on top. This tool's slider goes up to 64 characters — 12–16 characters is a reasonable minimum for everyday accounts, and 20+ characters is worth aiming for on high-value accounts like a password manager's master password.
Assume an attacker can try 1 billion combinations per second (roughly the ballpark for modern high-end cracking hardware). A 12-character password with all four character types enabled has entropy of about 6.55 × 12 ≈ 78.6 bits, meaning roughly 2^78.6 ≈ 4.4 × 10^23 possible combinations. Even if the attacker only needs to search half that space on average, it still takes about 2.2 × 10^23 ÷ 10^9 seconds ≈ 7 million years. Compare that to a 6-character all-lowercase password, which has only about 26^6 ≈ 300 million combinations — at the same cracking speed, that falls in under a second. The takeaway: every extra character adds exponential, not linear, protection.
No. The password is computed directly in your browser using crypto.getRandomValues (a cryptographically secure random number generator). The entire process involves zero network requests — there's no fetch call or server API anywhere in this page's code. The password only exists in your current browser tab and disappears the moment you refresh; it's never stored or transmitted anywhere.
Symbols expand the available character set from 62 (upper+lower+numbers) to roughly 94, raising entropy per character from about 5.95 bits to about 6.55 bits, which meaningfully increases how hard the password is to crack. If a site doesn't accept symbols, just uncheck the box — the tool automatically excludes that character set when regenerating.
For everyday accounts, aim for at least 12–16 characters with every character type enabled. For high-value accounts — banking, email, or a password manager's master password — 20+ characters is worth the extra effort. This tool supports 4 to 64 characters; longer is always safer, but check whether the site you're using accepts a password that long.
No. That pattern is a common word with predictable symbol substitutions (a→@, o→0) — cracking dictionaries and tools already account for these substitutions, so its real-world security is barely better than the original word. True security comes from fully random character combinations, not patterns that merely "look" complicated.
The output field will show a message asking you to select at least one character type, since there's no character pool left to draw from. Check any box (uppercase, lowercase, numbers, or symbols) and the tool immediately generates a new password.