Password Generator

Longer is almost always better. Twelve characters is the practical minimum these days, but sixteen or more makes brute-force attacks far less realistic. This tool defaults to 18 characters, which is a great balance of strength and convenience — and since your password manager remembers it for you, there's no reason to keep it short.

Yes. Passwords are generated on your device using crypto.getRandomValues, your browser's cryptographically secure random number generator — the same kind of randomness security tools rely on. Nothing is sent to any server, stored anywhere, or even logged. For real accounts, always pair a strong password with a password manager and two-factor authentication.

Adding symbols (like !, @, #) increases the number of possible characters an attacker must guess for each position, which strengthens the password. Some older sites reject certain symbols, though — if a site won't accept a symbol, just untick the box and make the password a few characters longer instead.

You don't have to — use a password manager. But if you must remember it, the trick is to generate one long password for your password manager's vault and let it store everything else. Trying to memorize a random 18-character string is a losing battle the penguin does not recommend.

Please don't. If one site gets breached, attackers try the same password everywhere else. Give every account its own password — this generator can make as many as you need, and a password manager keeps track of them all.