Skip to content
TabBench

Password Generator

Generate highly secure, cryptographically random passwords with customizable length, symbols, and memorability.

Runs in your browser. Nothing you add is uploaded.

What the Password Generator does

The strength of a password comes from entropy, not from cleverness. 'P@ssw0rd!' looks complex to a human and takes a cracking rig milliseconds, while a random 16-character string resists offline attack for longer than the systems protecting it will exist. This generator uses the browser's cryptographically secure random source rather than Math.random(), so the output is genuinely unpredictable, and it never transmits or stores what it produces.

How to generate a strong password

  1. Set the length. 16 characters is a sensible default; go to 20 or more for password managers, email, and anything financial.
  2. Choose character sets. Keeping uppercase, lowercase, digits, and symbols all enabled maximises entropy per character.
  3. Generate, then copy the result straight into your password manager rather than a notes app or a spreadsheet.
  4. Never reuse it. The value of a unique random password is destroyed the moment it protects two accounts.

The Password Generator runs entirely in your browser — nothing you enter is uploaded, stored, or logged.

When to use it

Seeding a password manager

Once a manager holds your credentials, you never type them, so length costs you nothing. Generating 24–32 character passwords for every stored account is effectively free security.

Creating service and API credentials

Machine-to-machine credentials are never typed by a human either, which makes them the ideal case for maximum length with the full symbol set enabled.

Producing a temporary password for a new user

When issuing an initial credential that will be changed on first login, generate it randomly rather than using a predictable pattern like the person's name plus a year.

Good to know

  • Length beats complexity. A 20-character lowercase-only password has more entropy than a 10-character password using every symbol on the keyboard.
  • Some systems silently truncate passwords at 16 or 20 characters. If a long password fails to work on re-entry, truncation is the likely cause.
  • Turn off ambiguous characters only if the password must be read aloud or typed from paper — it slightly reduces entropy per character.
  • A generated password is only as safe as where you store it. Do not email it to yourself.

Frequently asked questions

Are passwords saved anywhere?

Never. Passwords are generated directly on your device via CSPRNG.

Are the generated passwords stored or transmitted?

No. Generation happens entirely in your browser using the Web Crypto API, and the result exists only in your tab's memory and clipboard. There is no server request, no logging, and nothing persisted after you close the page.

What password length should I actually use?

16 characters is a strong general baseline. Use 20 or more for your password manager's master password, primary email, and banking. Below 12 characters, a mixed-character password is within reach of a determined offline attack against a leaked hash.

Is a random password better than a passphrase?

Per character, yes; per unit of memorability, no. A five-word random passphrase is roughly as strong as a 12-character random string and far easier to remember, which makes passphrases the better choice for the handful of passwords you must type from memory. Use random strings for everything a manager will remember for you.

How is this different from Math.random()?

Math.random() is a fast pseudo-random generator that is not designed to resist prediction — given enough output, its future values can be inferred. This tool uses crypto.getRandomValues(), which draws from the operating system's cryptographically secure entropy pool and carries no such weakness.

Should I change my passwords regularly?

Current guidance from NIST says no — forced periodic rotation pushes people toward predictable variations like appending a number. Change a password when there is evidence of compromise, and otherwise rely on uniqueness and length.