Tool
Random Password Generator
Generate a strong, truly random password — nothing sent anywhere.
Random Password Generator
Choose your length and which character types to include -- uppercase, lowercase, digits, symbols -- and get a password built from true cryptographic randomness, generated entirely in your browser and never transmitted anywhere.
Nothing about the password is logged, stored, or sent to a server at any point.
You control the character mix, so you can match whatever a specific site's password rules require.
How the Random Password Generator works — and why it's fair
The tool first builds a character pool from whichever types you've enabled (say, all four types gives roughly a 94-character pool of letters, digits, and common symbols). Each character in your password is then drawn independently from that pool using crypto.getRandomValues with rejection sampling sized to the exact pool, so every allowed character has an identical chance at every position -- no character type or position is favored.
The real strength of a password like this comes down to entropy: each independently-random character from a roughly 94-character pool contributes about 6.5 bits of entropy, so a 16-character password built this way has around 104 bits of entropy -- astronomically harder to guess or brute-force than a shorter password or a 'memorable phrase' style password, which tends to have far less real randomness per character than it looks like it does.
Because the pool size directly drives entropy per character, turning off a character type (say, disabling symbols) meaningfully lowers the effective pool and therefore the entropy of each character -- worth knowing if a site restricts what characters it accepts and you need to compensate with extra length.
One more entropy note worth having concretely: going from 12 to 16 characters (with all character types enabled) roughly triples the entropy, from about 78 bits to about 104 bits, which is a far bigger security gain than most people expect from adding just 4 characters -- length matters more than almost any other single factor in password strength.
When people reach for a real random password
New account signups where you don't need to memorize the password (a password manager will store it). Temporary shared credentials for a small team project. Wi-Fi guest network passwords that need to be strong but only typed in once. Seeding a password manager's initial vault password.
IT staff use it to generate one-time temporary passwords for new employee accounts that get changed on first login, since a genuinely random string is safer than a predictable pattern like 'CompanyName2026!'.
If you need a numbers-only PIN instead -- for a phone lock or door code -- the random PIN generator uses a narrower digit-only pool and explains the entropy tradeoff of digits versus a full mixed-character password.
Security-conscious teams sometimes generate a fresh random password here specifically to test whether a site's password-strength meter is calibrated sensibly, since a meter that rates a genuinely high-entropy random password as 'weak' is a sign the meter itself is poorly designed.
Frequently asked questions
Is the password logged or stored anywhere on a server?
No -- it's generated and displayed entirely client-side; nothing about it is transmitted or saved.
How strong is a 16-character password from this tool, practically?
With all character types enabled, around 104 bits of entropy -- well beyond what any realistic brute-force attack could crack in a meaningful timeframe.
Should I use a random password like this or a memorable passphrase?
A fully random password of the same length is generally stronger per character than a memorable phrase, but a passphrase can be easier to type manually if you're not using a password manager -- the right choice depends on how you'll store and use it.
Will it always satisfy sites that require uppercase, a digit, and a symbol?
As long as you leave those character types enabled, yes -- with all types on, the pool guarantees a strong mix, though a specific generated password could occasionally land without one type by chance on very short lengths.
Does turning off symbols weaken the password?
Yes -- shrinking the character pool lowers the entropy contributed by each character, so a symbol-free password needs to be longer to reach the same overall strength.
Can I exclude ambiguous characters like 0, O, 1, and l?
If your version of the tool offers that toggle, enabling it removes commonly-confused characters from the pool at a very small entropy cost.
Is a 12-character password long enough in 2026?
With all character types enabled it's reasonably strong for most everyday accounts, but 16 or more characters is a safer baseline for anything protecting sensitive data.