Password generator

Randomness is the whole game

Password-cracking software does not sit there guessing blindly — it starts with dictionaries, keyboard walks and the well-worn recipe of a word, a year and an exclamation mark, and it burns through billions of those per second. What defeats it is not cleverness but entropy: every genuinely random character you add multiplies the number of possibilities an attacker has to try. Going from eight random characters to sixteen does not double the work — it multiplies it by a factor with roughly fifteen zeros on the end. That is why the length field here goes all the way up to 128, and why a long password of plain letters comfortably beats a short one bristling with substitutions. If a site caps the length, max out whatever it allows before worrying about anything else.

The characters you will never see here

Look closely at a few results and you will notice certain characters never appear. That is deliberate: the character pools leave out the classic look-alikes — capital I and O, lowercase l and o, and the digits 0 and 1 — so a password read from a printout, a screenshot or over the phone can be typed back in without squinting at whether that vertical stroke is a letter or a number. The symbols set sticks to characters that almost every website accepts, because nothing is more irritating than a password rejected after you have already saved it. Everything reacts live, too: change the length or tick a set on or off and a fresh password appears immediately, with the Generate button there whenever you fancy another roll of the dice.

One password, one place

A generated password only protects you if each account gets its own — reuse one strong password everywhere and a single leaked database unlocks the lot, which is exactly how most account takeovers happen. Keep them in a password manager rather than in your head; the manager also removes the last excuse for short passwords, since you never type them yourself. Like everything in our Developer & Data category this tool is free without limits, and what it generates never leaves your browser. One more tip if you build websites yourself: never store what your users type at sign-up. Run it through our bcrypt hash generator and store the salted hash instead — then a stolen database hands an attacker homework rather than keys.

What makes a password strong

Strength comes from randomness and length, not cleverness — a long random string beats a short one with substitutions like "@" for "a". Every character here is chosen using the browser's cryptographically secure random number generator, not a predictable pattern.