password generator

Pick a length and the kinds of characters you want, and a new password appears with every change. Each character is picked with your browser’s cryptographic random number generator, the same source used for encryption keys.

Everything happens on your device. The password is never sent anywhere or stored. Only your settings are remembered in this browser.

The number under the controls is the password’s entropy in bits: its length times log₂ of the character set. Every extra bit doubles the number of guesses an attacker would need.

A strong password is long, random and unique. Length matters most: every extra character multiplies the number of possible passwords by the size of the character set. Randomness comes next. Passwords made up by people follow patterns, like names, dates and words with a number at the end, and cracking tools try those first. A generated password has no pattern to guess.

For most accounts, 16 characters with upper and lower case letters, digits and symbols gives about 100 bits of entropy, far beyond what anyone can brute-force. For your email, your password manager and your bank, use 20 characters or more. If a site doesn’t accept some symbols, turn symbols off and add a few more characters instead.

Use a different password for every site, so a leak in one place can’t unlock the others. A password manager remembers them for you, so you only need to know one strong master password. Turn on two-factor authentication wherever you can. It protects the account even if a password gets out.