Password generator: strong, random, private

Generate a 12, 15, or 20-character password

The preset lengths reflect common service requirements, not equally strong recommendations. Eight characters may satisfy an old rule but offers a much smaller search space than a longer output. Twelve random characters can be useful where a service imposes a short maximum. Fifteen or sixteen provides more margin, and twenty is a practical default when a password manager will store and fill the result. Use the longest length the service accepts comfortably.

Each character is selected with crypto.getRandomValues and rejection sampling. Rejection sampling discards random byte values that would create modulo bias when mapped into a character set. When several character groups are enabled, the generator includes each selected group and shuffles the final output with the same unbiased selection method. Nothing is derived from the clock, page state, your name, or a predictable pseudo-random function.

How to create a strong password

A strong generated password is long, unique to one account, and stored rather than memorized. Reuse is often more dangerous than a missing symbol because one service breach can expose another account. Put the generated value directly into a reputable password manager, confirm that the manager saved it for the correct domain, and avoid sending it through chat or email. Keep the account’s recovery method independent and current.

Character toggles exist for compatibility. They are not an invitation to weaken the output until it resembles a human-made word. If a service accepts only letters and digits, increase length to compensate for the smaller pool. Excluding ambiguous characters can help when a value must be read or typed, but autofill is preferable. PIN mode produces random digits and is appropriate only where the system rate-limits attempts and specifically requires a PIN.

Understanding password strength and entropy

The entropy display estimates the size of the generator’s possible output space under the selected settings. It is meaningful because this page chooses from a defined pool with a cryptographic random source. The same arithmetic should not be applied to a password invented by a person: human choices, substitutions, dates, keyboard paths, and favorite phrases are not uniformly distributed. The displayed value is therefore an estimate of this generated output, not a universal password score.

Crack-time figures use explicit assumptions. The offline scenario assumes one trillion guesses per second against stolen fast hashes, an intentionally aggressive comparison that may be faster or slower than a real system. The online scenario assumes ten guesses per second and continuous attempts, while responsible services rate-limit far more strictly. Both show the average time to search half the space. Phishing, malware, session theft, and password reuse bypass this arithmetic entirely.

Store the result without exposing it

Copy the result only when the destination is the verified service or your password manager. Clipboard contents can be visible to other applications, synchronization features, and clipboard-history tools, so complete the save promptly and clear history if your environment requires it. This page does not persist generated values in local storage, cookies, analytics, or a server. Regenerating replaces the visible value, and refreshing removes it from the page.

After saving, test the new sign-in from a private window while the original trusted session remains open. Confirm that autofill selects the correct domain and that recovery still works. Add a passkey or strong second factor when supported. A generated password is a robust building block, but it cannot compensate for entering it into a lookalike site or approving an attacker’s recovery change.

Practical sequence

How to use this tool safely

1. 01

   Choose a supported length and keep every compatible character group enabled.

2. 02

   Generate the value with the browser’s cryptographic random source.

3. 03

   Copy it directly into the verified service or a trusted password manager.

4. 04

   Test the saved sign-in before closing the original account session.

References

Primary guidance

• NIST SP 800-63B authentication guidance