Password Generator

Randomness here comes from the browser's cryptographic random source, not from Math.random(), which is fast but predictable and unfit for anything security-bearing. There is a subtler trap that this tool also avoids: reducing a random number into an alphabet with the remainder operator biases the result toward the earlier characters, because the range does not divide evenly. Values that would land in the uneven tail are discarded and redrawn instead, so every character is genuinely equally likely.

Length does more for strength than complexity does. Each additional character multiplies the search space, while adding a symbol to a short password merely widens the alphabet a little — which is why a 20-character password of letters alone is far stronger than an 8-character one with punctuation. Aim for 16 or more where a site permits it, use a different password everywhere, and keep them in a password manager, since the only real answer to remembering dozens of unique passwords is not to.

Common questions

Is a password generated here safe to use?

Yes. It is produced by your browser's cryptographic random number generator, the same class of source used for encryption keys, and it never leaves the page — it is not sent to us, not written to storage and not recoverable afterwards. Closing the tab without copying it means it is gone, which is the intended behaviour.

How long should a password be?

Sixteen characters or more wherever the site allows it. Length contributes more than character variety, because every extra character multiplies the number of possibilities, while adding one symbol only widens the alphabet slightly. A long password of ordinary letters beats a short one bristling with punctuation, and it is easier to type.

Why does the generator sometimes discard a random value?

To avoid modulo bias. Folding a random number into an alphabet with the remainder operator favours the earlier characters, because the number of possible values does not divide evenly by the alphabet size. Values falling in the uneven remainder are thrown away and redrawn, which keeps every character exactly as likely as every other.

Should I use a password manager?

Yes. The advice to use a long, unique password on every site is only workable if something else remembers them, and reuse is what turns one site's breach into a compromise of your email and bank. Generate here, store there, and enable two-factor authentication wherever it is offered.