Password Generator & Strength Checker
Generate a strong, random password using your browser's cryptographically secure random number generator, or check the strength of a password you already have. Nothing is ever sent anywhere.
Generate a password
Check your own password's strength
How to use this tool
- Adjust the length slider and character-type checkboxes, then a password generates automatically.
- Click Regenerate for a new one with the same settings, or Copy to copy it.
- Already have a password in mind? Paste it into check your own password's strength for live feedback.
What the strength check looks at
- ✓ Estimated entropy (bits) from length and character variety
- ✓ Membership in a list of extremely common passwords
- ✓ Repeated characters (e.g. "aaaaaaaa")
- ✓ Sequential runs (e.g. "abcd", "1234")
- ✓ Missing character categories (no numbers, no symbols, etc.)
FAQs
Is it safe to generate a password in my browser?
Yes — the password is generated locally using crypto.getRandomValues(), the browser's cryptographically secure random number generator (not Math.random(), which is not safe for anything security-related). Nothing is sent to a server, and nothing is stored once you leave the page.
What makes a password strong?
Length matters more than complexity: a 16-character random password is far stronger than an 8-character one with mixed symbols. The strength meter here estimates entropy (how many guesses an attacker would need) from your character set and length, and separately flags specific weaknesses like common passwords, repeated characters, or sequences like "1234".
Is my password sent anywhere when I check its strength?
No. The "check your own password" field runs the same strength estimate locally in your browser as you type — it is never transmitted, logged, or stored.
Why exclude ambiguous characters like l, I, O, 0, and 1?
In some fonts these look nearly identical, which causes mistakes when a password is read off a screen or written down and typed in manually (a printed temporary password, for example). Excluding them trades a tiny amount of entropy for fewer transcription errors.
Should I reuse a strong password across multiple sites?
No — even a very strong password should be unique per site. If one service is breached, a reused password lets an attacker try it against your other accounts (a technique called credential stuffing). Generate a new one per account and use a password manager to store them.