Strong Password Generator

How to use the password generator

Generate cryptographically random passwords using crypto.getRandomValues() — the same source browsers use for SSL, never Math.random(). Generation runs entirely in your browser; passwords never leave the page or hit any logs.

• 1. Pick a length. 16 chars minimum for accounts you care about; 24+ for high-value secrets, service tokens, root credentials. Each extra char doubles the search space.
• 2. Toggle the character classes you need: lowercase, uppercase, digits, symbols. Disabling symbols halves entropy per char — only do it if the target system rejects them.
• 3. Optionally exclude visually similar characters (O/0, l/1/I) for passwords meant to be typed manually.
• 4. Click "Generate" — or set a count to produce a batch (10–50) for password-rotation rollouts.
• 5. Copy with one click. The clipboard is auto-cleared after 30 seconds in modern browsers; transfer immediately to a password manager.

Common mistakes to avoid

• Reusing passwords across sites. One breach exposes every account. Use a password manager (1Password, Bitwarden, KeePassXC) — not a spreadsheet, not your browser without a master password.
• Generating "memorable" passwords with predictable patterns. A 16-char password from [a-z]+digit is far weaker than full alphanumeric+symbols. Always include all four classes.
• Storing passwords as MD5 or plain SHA-256 server-side. Both are too fast — attackers crack billions/sec on a GPU. Use bcrypt, argon2id, or scrypt with a slow factor.
• Using diceware passphrases without enough words. 4 words from a 7776-word list is ~52 bits of entropy — borderline. Use 6+ words for high-value accounts.
• Pasting passwords into chat to share. They get logged in DM history, backups, sync indexes. Use a one-time secret service (1Password share, Bitwarden Send) or a TOTP-based handoff.
• Trusting in-browser password generators that send to a server. Inspect the network tab. A real generator (like this one) makes zero requests when you click Generate.