About this tool
Characters are chosen with crypto.getRandomValues, your browser's cryptographically secure random generator, using rejection sampling so every character is equally likely. Each chosen character type is guaranteed to appear at least once. Strength is shown as entropy, the number of guesses an attacker would need expressed in bits: 80 bits or more is very strong for online accounts.
Best practice: use a different password for every account, store them in a password manager, and turn on two-factor authentication where possible.
Good to know
- Passwords are not saved; once you leave the page they are gone.
- Some sites restrict which symbols are allowed. Untick Symbols if a site rejects the password.