How to use it
A new password is made when the page opens and each time you change a setting or press New password. Press Copy to put it on your clipboard. Tick "No look-alikes" if you will need to read it out or type it by hand.
How it stays safe
- The password is made on your device with your browser's cryptographic random number generator (
crypto.getRandomValues), the same kind used for encryption keys. - It is never sent to a server, and this page does not save it.
- Every character type you tick appears at least once, and the order is shuffled.
How strength is measured
Strength is shown in bits of entropy: length × log₂(number of possible characters). Each extra bit doubles the number of guesses an attacker needs.
Example: 16 characters from all four sets (86 characters) is 16 × log₂(86) ≈ 103 bits. That is far beyond what anyone can guess.
| Bits | Rating |
|---|---|
| Under 50 | Weak |
| 50–69 | Fair |
| 70–99 | Strong |
| 100 and over | Very strong |
Common questions
How long should a password be?
At least 12 characters for everyday accounts. 16 or more for email, banking and anything that can reset your other passwords. Length matters more than symbols.
Should I write it down?
Use a password manager instead. It remembers a different strong password for every site, so one leaked site does not unlock the others. Turn on two-step login where you can.
Last checked: 2026-09-25