Password Generator
Generated locally — no data sent to servers.
- Choose the length.
- Tick which sets to include: uppercase, lowercase, numbers and symbols.
- Enable "exclude similar" to drop characters that look alike.
- Copy the generated password.
Every extra character multiplies the number of possible combinations. Every extra character set merely widens the base — a real gain, but a smaller one.
In practice, a long password with few character types resists better than a short one full of symbols. Twelve characters is a reasonable floor today; sixteen is comfortable.
That is why current guidance from the main security references changed: instead of mandating a symbol and a number, it prioritises length and bans already-breached passwords.
Generation here uses the browser’s cryptographic randomness source, not the ordinary pseudorandom generator. The difference matters: the ordinary one is predictable if someone knows its internal state.
It removes characters that look alike in many fonts: zero and the letter O, one and the letters l and I.
It matters when the password will be read aloud, typed from paper, or transcribed from one screen to another device — common with wifi passwords and initial device credentials.
The cost is a slight reduction in the combination space. For passwords stored in a manager and never typed by hand, leave it off.
A strong password is only useful if it is unique. Reusing the same password across services means one breach compromises them all — and breaches happen at services you do not control.
Since nobody memorises dozens of unique passwords, a password manager stops being a convenience and becomes a requirement. You memorise one strong master password and the manager handles the rest.
Wherever a second factor is available, turn it on. It protects even in the cases where the password leaks.
Generation happens entirely in your browser: no password is transmitted or logged.
Frequently asked questions
Twelve characters is a reasonable floor, sixteen is comfortable. Length matters more than symbol variety, because each extra character multiplies the combinations.
No. Generation uses the browser’s own cryptographic randomness source and nothing leaves your computer.
They help, but less than people assume. A long password without symbols is usually more resistant than a short one full of them. Some systems still reject certain symbols, another reason to prioritise length.
When the password will be read aloud, copied from paper or typed on another device — typical of wifi passwords. For use in a manager, leave it off.
Current guidance is to change on suspicion of compromise, not on a calendar. Frequent forced rotation leads people to pick worse, predictable passwords.