Password Generator

The Password Generator creates strong, random passwords using the Web Crypto API — cryptographically secure randomness that can't be predicted or reverse-engineered from a seed. Choose your length (16 characters recommended, 20+ for high-value accounts) and character classes (uppercase, lowercase, digits, symbols), and generate as many as you need. Everything happens locally in your browser: the passwords are never sent over the network, never logged, and never stored. The single most important defence against modern credential attacks is using a long, unique, random password for every account, combined with a password manager. Reused passwords are what turn one company's data breach into a compromise of your email, bank, and social accounts — attackers routinely take leaked username/password pairs and try them across hundreds of other sites (a technique called credential stuffing). One breached, reused password is enough to unravel your entire online identity. Length matters more than complexity. A 16-character random password made of just lowercase letters and digits has roughly 82 bits of entropy — infeasible to brute-force with any current or foreseeable hardware. Adding uppercase and symbols pushes that above 100 bits, which is overkill for anything short of nation-state adversaries. What length definitively defeats is human guessing and dictionary attacks, both of which crush weak, memorable passwords like "Summer2024!" almost instantly. The generator lets you exclude ambiguous characters (0/O, 1/l/I) for situations where the password must be typed manually or read aloud — WiFi credentials, printed backup codes, and legacy systems that can't display in a clear monospace font. For accounts that don't support symbols, disable that class rather than trying to work around it in the site's signup form. Some sites still have arcane character restrictions; the generator lets you match them exactly. Store generated passwords in a reputable password manager (Bitwarden, 1Password, Proton Pass, or your browser's built-in manager). Never store them in plain text files, spreadsheets, or notes apps unless those apps are themselves encrypted. Enable two-factor authentication (ideally with a hardware key or authenticator app, not SMS) on every account that supports it — this is a much bigger security lift than any password change on its own. Modern guidance from NIST (SP 800-63B) explicitly discourages routine password rotation for personal accounts. Only change a password if there's a specific reason: a breach notification, suspicious activity, or a device compromise. Rotating strong random passwords on a schedule adds no security and encourages people to pick weaker, patternable variants. Everything runs in your browser using cryptographically secure randomness. Combine this tool with the QR Code Generator for sharing WiFi credentials safely and the Character Counter to check length requirements on strict signup forms.