Choose length
Pick 16 or more characters for most accounts, or the longest length the website allows.
Create long, unpredictable passwords on your own device. No sign-up, no sending passwords to a server, and no weak random shortcuts.
Secure password creator
Adjust the length and character types below. The password updates whenever an option changes.
Estimated resistance to guessing will appear here.
Use at least 12 characters for important accounts and 16 or more where possible.
Batch mode
Useful when you are setting up several accounts. Copy each one separately and save it in your password manager straight away.
This page only
The last 10 passwords generated in this open page. History is kept only in page memory and disappears when you close or refresh the page.
Stay safe
Generated on your device: this tool creates passwords locally in your browser and never sends or stores them on a server. Even so, only use a password after saving it somewhere secure.
Use a password manager: save every password in a reputable password manager, use a different password for every account, and turn on two-factor authentication where available.
Length beats tricks: a unique password of 12+ characters is a minimum for important accounts. Longer passphrases and generated passwords are harder to guess than short, complicated-looking ones.
Quick guide
Pick 16 or more characters for most accounts, or the longest length the website allows.
Turn on the character types accepted by the site. Exclude ambiguous characters if you may need to read the password aloud.
Copy the generated password, sign up or change the password, then save it immediately in your password manager.
FAQ
No. Generation happens in your browser. The recent-history list exists only in this page’s memory and is not saved to local storage, a cookie or a server.
Use at least 12 characters for important accounts. Sixteen or more is better, especially for email, banking and your password-manager master password strategy.
It is based on the password length and size of the selected character set. It assumes an attacker can try about 10 billion guesses per second and needs, on average, half of the possible combinations. Real attacks vary, so treat it as a rough comparison—not a promise.
No. A strong password still becomes unsafe if one website leaks it and you have used it elsewhere. Generate a unique password for every account.