Random Password Generator at a glance
- What it does
- Generate strong random passwords with adjustable length and character sets, using your browser cryptographic random source. Nothing is sent or stored.
- Where it runs
- Entirely in your browser — no data is uploaded
- Works offline
- Yes, once the page has loaded
- Cost
- Free, with no account and no usage limit
- Category
- Generators & Security
How to use the generator
- Set the length. Sixteen characters is a sensible default; twenty or more for anything that protects other accounts.
- Choose the character sets - uppercase, lowercase, digits, symbols.
- Generate, and regenerate freely until you get one you are happy with.
- Copy it straight into your password manager, not into a note or a spreadsheet.
Length beats complexity
Every character you add multiplies the search space; adding a symbol to a short password barely moves it. The arithmetic is decisive.
| Password | Combinations | Verdict |
|---|---|---|
| 8 characters, all sets | ~6 × 1015 | Falls to a well-resourced offline attack. |
| 12 characters, all sets | ~5 × 1023 | Reasonable for most accounts. |
| 16 characters, all sets | ~4 × 1031 | Strong. |
| 20 characters, all sets | ~4 × 1039 | Beyond any foreseeable attack. |
| 4 random words | ~3 × 1015 | Comparable to 8 mixed characters, and far easier to remember. |
| 6 random words | ~2 × 1023 | Strong and memorable. Good for the passwords you must type. |
This is why current NIST guidance dropped mandatory complexity rules and mandatory rotation, and emphasised length instead. Forcing a symbol and a capital produces Password1!, which attackers try first.
What the current guidance actually says
NIST Special Publication 800-63B, revised in 2017 and reaffirmed since, reversed decades of received wisdom. The recommendations that matter:
- Do not force periodic changes. Rotation makes people pick weaker, more predictable variations. Change a password when there is evidence of compromise.
- Do not impose composition rules. They reduce entropy in practice by pushing everyone into the same patterns.
- Do check against breach lists. This is far more effective than any complexity rule.
- Allow long passwords and all characters, including spaces and Unicode. A maximum length below 64 usually indicates the password is being stored badly.
- Allow paste. Blocking it prevents password manager use and makes everyone less safe.
Use a password manager
A generator is only useful alongside somewhere to keep the result. The entire benefit of unique random passwords is that a breach at one site cannot open any other account - and that requires a different password everywhere, which nobody can memorise.
The practical arrangement: one long passphrase you actually remember for the manager itself, unique generated passwords for everything else, and two-factor authentication on your email and on the manager. Your email is the highest-value target you own, because it can reset everything else.
Any reputable manager is dramatically better than reusing passwords. Browser-built-in managers are acceptable; dedicated ones offer better sharing and recovery.
Why the random source matters
Math.random() is a fast pseudo-random generator with a small internal state, not designed for security. Given enough output, its future values can be predicted. Passwords generated from it have been recovered in practice.
This generator uses crypto.getRandomValues(), which draws from the operating system's cryptographic entropy pool - the same source used for TLS keys. It also avoids modulo bias, a subtle flaw where naively mapping random bytes onto a character set makes some characters slightly more likely than others.
The generated password never leaves this page. It is not logged, not transmitted and not recoverable - so copy it before you navigate away.
Frequently asked questions
Sixteen characters for ordinary accounts, twenty or more for email, banking and your password manager. Length matters far more than which symbols you include.
It depends entirely on whether generation happens locally. Here it does: the password is produced by your browser's crypto API and never transmitted. A tool that generates server-side is a different proposition, and you cannot tell from the outside - which is why a password manager's built-in generator is the safest habit.
No, not on a schedule. Current NIST guidance advises against it, because forced rotation leads to predictable variations. Change a password when you have reason to believe it is exposed.
For anything you must type from memory, yes - six random words are both strong and memorable. For everything stored in a manager, random characters are more compact and equally strong. The critical part is that the words are chosen randomly, not by you.
Some sites cap length or ban certain symbols, usually a sign of poor storage practices. Regenerate without symbols, or shorter. It is worth noting which sites do this, since it correlates with other security shortcuts.
Nothing you enter here leaves your browser
Random Password Generator does its work in JavaScript running on your own device. The page loads once, and after that there is no upload step and no server involved — which matters here because a generated password or key is worthless the moment a third party has a copy of it.
You can verify this rather than taking our word for it: load the page, disconnect from the internet, and the tool keeps working. Our privacy policy sets out what is and is not collected, and this guide explains why the distinction matters.