Tools
Password generator
Create strong, random passwords in your browser, with the length and characters you choose.
The password is created in your browser using the browser's own cryptographic random generator. It is not sent or stored anywhere.
About this tool
This generator creates random, hard-to-guess passwords in one click. You choose the length, from 4 to 64 characters, and which types of characters you want —lowercase, uppercase, numbers and symbols— and the tool guarantees at least one of each type you have ticked.
The password is created in your browser using the browser's own cryptographic random number generator, the same kind of randomness used for encryption. It is not sent to any server, not stored and cannot be recovered: copy it and keep it somewhere safe.
How do I use the password generator?
- Move the length slider to the number of characters you want. It starts at 16.
- Tick the character types accepted by the site where you will use it: lowercase, uppercase, numbers and symbols.
- If you will need to read or type it by hand, tick “No look-alike characters” to remove 0, O, o, 1, l and I.
- Click “Generate another” until you like it, then “Copy”. Paste it straight into the form or your password manager.
What makes a password strong?
Mainly three things: being long, random and unique. Length matters most: every character you add multiplies the possible combinations. Randomness matters because the passwords people invent follow patterns —names, dates, words with a number at the end— that attack programs try first. And unique means never reusing it: if one website suffers a data breach, that password no longer protects any other account where you use it.
The tool shows each password's randomness in bits. It measures how many combinations would have to be tried: each extra bit doubles the number of attempts. A 16-character password with lowercase, uppercase and numbers is around 95 bits. As a practical rule, longer is better, and 16 characters is a good starting point for important accounts.
Symbols help, but less than you might think: with 16 characters, adding symbols to lowercase, uppercase and numbers raises the randomness by about 8 bits, roughly the same as making the password one or two characters longer. If a site does not accept symbols, make up for it with extra length.
How should you store and manage passwords?
Nobody can remember a different random password for every service, and you do not need to: that is what password managers are for. They store your passwords encrypted and fill them in for you. With a manager you only need to remember one master password, which should be long and not used anywhere else.
As well as a good password, turn on two-step verification for your business email, bank and social media accounts. That way, even if someone gets the password, they cannot get in without the second factor.
What you should never do
Do not reuse the same password on several sites, do not send it by email or messaging in plain text, do not write it on a sticky note on your screen and do not use personal details that are easy to find out, such as your company name, its founding date or your dog's name. If you suspect a password has leaked, change it as soon as possible everywhere you have used it.
Frequently asked questions
Is it safe to generate passwords on a website?
On this one, yes: the password is generated in your browser with cryptographic randomness and never travels over the internet or gets stored. You can check by disconnecting from the internet after opening the page: it still works.
How long should a password be?
The longer the better. For important accounts, 16 characters or more is a good starting point. If the site allows it, use every type of character.
Why remove look-alike characters?
For passwords someone has to read or copy by hand, such as an office wifi password. Removing 0, O, o, 1, l and I avoids mistakes, at the cost of slightly less randomness.
Do you store the passwords you generate?
No. They never leave your browser. If you close or reload the page without copying it, the password is lost and cannot be recovered.