Create strong, unique passwords — or memorable passphrases — using the cryptographically secure random generator built into your browser. Nothing is uploaded, stored or tracked: generation happens entirely on your device. Free, no sign-up.
Why local-only matters
A password generator is the last tool that should run on someone else's server. A server-side generator sees the exact password it made for you — and anything a server sees can be logged, leaked or subpoenaed, silently linking a fresh password to your visit. This tool is different: it is a single web page that does all the work with JavaScript in your own browser. Passwords are created on your device, shown on your device, and copied from your device. The history list never leaves this tab's memory. You can even disconnect from the internet after the page loads and it will still work. Nothing to upload means nothing to leak, log or misuse.
What makes a password strong?
Strength is measured in entropy bits: roughly, how many yes-or-no guesses an attacker needs to crack your password. Two things raise it — length and pool size. Every extra character multiplies the search space by the size of the pool it is drawn from, which is why length beats clever substitutions: P@ssw0rd! looks complex but follows patterns cracking tools try early, while a plain 20-character random password drawn from letters, digits and symbols carries about 129 bits of entropy. At a trillion guesses per second, exhausting that space would take vastly longer than the age of the universe. The meter above computes the entropy of your current settings live, so you can watch what each extra character buys you.
Frequently asked questions
Are the passwords generated on a server?
No. Every password is created locally, in this browser tab, using JavaScript. Nothing you generate is sent over the network, stored in a database or logged anywhere — there is no server involved at all. You can even load this page, disconnect from the internet, and keep generating passwords offline.
How random are these passwords, really?
They are drawn with crypto.getRandomValues, the cryptographically secure random number generator built into your browser — the same source your browser uses for encryption keys. We never use Math.random, which is predictable. Characters are picked with rejection sampling, so every character in the set is equally likely and no character is subtly favored.
What makes a password strong?
Length and variety. Every extra character multiplies the number of guesses an attacker needs, and mixing uppercase, lowercase, digits and symbols enlarges the pool each character is drawn from. This page shows the entropy of your settings in bits: a 20-character password using all four character types has about 129 bits of entropy, which is far beyond any realistic brute-force attack.
Should I use a random password or a passphrase?
Use random passwords for anything stored in a password manager — they pack the most entropy into the fewest characters. Use a passphrase for the few passwords you must memorize or type by hand, like your master password or Wi-Fi key: four or five random words are much easier to remember and type, while still being hard to guess.
Is my password history saved anywhere?
No. The history list on this page lives only in this tab's memory, to make it easy to copy a password you just made. It is never written to local storage, cookies or any server, and it disappears completely the moment you refresh or close the tab.
Can I reuse one generated password for all my accounts?
Please don't. A strong password only protects the account it belongs to — if one site leaks its database, reused passwords let attackers walk into your other accounts. Generate a unique password for every account and let a password manager remember them all.