Create strong, random passwords in one click
Pick a length, choose which characters to include and copy the result. Every password is generated locally in your browser with the Web Crypto API, so nothing you create here is sent to or stored on our server.
How to generate a strong password
- Set the length. Drag the slider to 16 characters or more. Length adds more strength than any other setting.
- Choose the character sets. Letters, numbers and symbols are enabled by default. Turn on Complex characters only if the site accepts brackets, quotes and slashes.
- Regenerate or shuffle. The refresh button creates a new password; Shuffle reorders the current one.
- Copy it straight into your password manager. Use the green Copy Password button and save it right away.
What makes a password strong?
Strength comes from two things: how long the password is and how many different characters it can contain. Each extra character multiplies the number of possible combinations an attacker has to try.
| Settings | Possible characters | Strength of 12 chars | Strength of 16 chars |
|---|---|---|---|
| Numbers only | 10 | ~40 bits (weak) | ~53 bits (weak) |
| Letters only | 52 | ~68 bits | ~91 bits |
| Letters + numbers | 62 | ~71 bits | ~95 bits (strong) |
| Letters + numbers + symbols | 78 | ~75 bits | ~100 bits (strong) |
As a rule of thumb, aim for at least 16 random characters for important accounts such as email, banking and your WordPress admin user.
Is this password generator safe to use?
Yes. The password is created by JavaScript running on your own device using crypto.getRandomValues(), the cryptographically secure random number generator built into every modern browser. The value is never sent over the network, logged or saved, and it disappears when you close the tab.
Password best practices
- Use a unique password for every account so one leak cannot unlock the others.
- Store passwords in a password manager instead of a document or the browser notes.
- Turn on two-factor authentication wherever it is offered, including WordPress (see our guide to securing WordPress admin access with 2FA).
- Never reuse a password you have already used on a site that was breached.
Frequently asked questions
How long should a password be?
Use at least 12 characters for everyday accounts and 16 or more for email, financial and admin accounts. Longer is always better when you use a password manager.
Do I need symbols in my password?
Symbols add strength, but length matters more. If a site rejects symbols, increase the length instead: 18 letters and numbers are stronger than 12 characters with symbols.
Can I use these passwords for WordPress and WooCommerce?
Yes. WordPress accepts all of the characters this tool produces. If you manage user accounts on a store, read our WordPress security best practices as well.
What does the Shuffle button do?
It keeps the same characters but puts them in a new random order. Use the refresh button when you want completely new characters.
Learn more about password security
- Why strong passwords matter more than you think
- The psychology of passwords
- Authentication methods beyond passwords
2019-2026 ©