What makes a password truly secure?

A truly secure password has three properties : Length — 16+ characters recommended in 2026. Every additional character makes brute-force attacks exponentially harder. Complexity — A mix of uppercase, lowercase, digits, and symbols. It helps, but length matters most. Uniqueness — Never reuse passwords across accounts. If one site is breached, all accounts sharing that password are compromised. The most important factor is length . The generator creates long, complex, random passwords that meet all three criteria. Store them in a password manager so you only need to remember one master password.

What formats are available for batch export?

The export menu downloads your generated batch in one of three formats : TXT — one password per line, plain text. Best for quick copy-paste workflows. CSV — a Password column with each value quoted, ready to open in a spreadsheet or import into most password managers. JSON — a structured array of strings, ideal for scripts, automation, or tooling that consumes the passwords programmatically. All downloads happen entirely in your browser — nothing is uploaded to a server.

What are the configurable symbol sets and why would I use them?

Not all sites accept the same symbols, so the generator lets you choose which set to draw from: Standard ( !@#$% ) — accepted nearly everywhere. Extended — a larger set for maximum entropy. Minimal ( !@#$ ) — for the most restrictive sites. URL-safe — only characters that never need escaping in URLs. Bash-safe — symbols that don't require shell escaping. Custom… — type any exact set of symbols you want. If a site rejects your password due to symbols, switch to a smaller set or define a custom one rather than dropping symbols entirely — length can compensate for the reduced pool.

Strong Password Generator — Create Secure Random Passwords

Create strong, unique passwords in seconds — right in your browser, with nothing sent to any server. Tune length and character types, apply a preset or a company rule set, pick a symbol set, and generate up to 100 passwords at once with real-time strength checks and local history.

0Very Weak

Entropy

0.0 bits

Length

0 chars

Crack Time

Instant

Char Pool

Character Composition

Uppercase0

Lowercase0

Digits0

Symbols0

Exclude characters

What is Password Generator?

A password generator creates cryptographically random passwords using your browser's secure random number generator. It's the fastest way to create strong, unique passwords for every account.

Cryptographically secure — uses crypto.getRandomValues() for true randomness, not predictable Math.random().

Fully customizable — control length, character types, symbol sets, restrictions, and exclude specific characters.

Bulk generation — create up to 100 passwords at once for batch account setup; duplicates are flagged and can be re-rolled.

Local history — the last 25 generated passwords are stored locally for quick reuse.

Zero-Server Tool Data Guarantee

All passwords are generated entirely in your browser using the Web Crypto API. Settings and history are stored only in your browser's localStorage. No generated password is ever sent to any server.

How to Use

Set Your Length

Choose how long you want your password to be. A length of 12-16 characters is generally recommended for high security.

Choose Characters

Toggle between uppercase, lowercase, numbers, and symbols to meet specific security requirements or website constraints.

Configure the Symbol Set

Pick a preset symbol set (standard, extended, URL-safe, etc.) or define a custom set of symbols for sites with unusual constraints.

Generate in Bulk

Set the quantity above 1 to generate multiple passwords at once. If duplicates appear, use 'Re-roll duplicates' to make every password unique.

Export Your Passwords

Use the export dropdown to download your generated passwords as TXT, CSV, or JSON. Great for storing securely in a password manager.

Reuse from History

Your last 25 generated passwords are saved locally. Re-copy one anytime, or clear the history with one click.

Common Use Cases

New Account Registration

Generate a strong, unique password when signing up for any online service.

Password Rotation

Periodically regenerate passwords for critical accounts like email, banking, and work systems.

API Key Generation

Create long, random strings for API keys, tokens, or secret values in your applications.

Batch Account Setup

Generate multiple unique passwords at once when migrating accounts or setting up team members.

Implementation Examples

JavaScriptSecure Random Password (Browser)

function generatePassword(length = 16, chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*') {
    const array = new Uint8Array(length);
    crypto.getRandomValues(array);
    return Array.from(array, b => chars[b % chars.length]).join('');
}

const password = generatePassword(20);
// "k$9Lm#2xP!qR@nBv&Wz*"

Generator Presets

Preset	Length	Character Sets	Best For
All Characters	16	Upper + lower + digits + symbols	Maximum security
Easy to Read	16	Upper + lower + digits + symbols (no ambiguous)	Sharing verbally
Easy to Say	14	Upper + lower (no digits/symbols)	Simple accounts
Maximum	32	All characters	Critical systems
PIN	8	Digits only	2FA backup codes

Company Presets

Company	Length	Character Sets	Notes
Google	16	Upper + lower + digits + symbols	Broad character set
Microsoft	16	Upper + lower + digits + symbols	No ambiguous characters
Apple	14	Upper + lower + digits	No symbols required
Amazon	16	Upper + lower + digits + symbols	Broad character set
GitHub	16	Upper + lower + digits + symbols	Broad character set
Meta / Facebook	12	Upper + lower + digits	No symbols required
PayPal	16	Upper + lower + digits + symbols	Broad character set

Production Best Practices & Security

Generate 16+ character passwords — longer is always stronger; 16 characters with mixed types provides ~100 bits of entropy. Why:Each additional character increases the total combinations exponentially. A 16-character password is trillions of times harder to crack than an 8-character one.

Use a unique password for every account — a password manager makes this practical. Why:If one service is breached and you reuse passwords, attackers can use those same credentials to log into your email, bank, and social media.

Apply restrictions when needed — some sites forbid symbols; use the exclusion or symbol-set feature without sacrificing security. Why:While symbols add complexity, length is a more significant factor in security. If a site doesn't allow symbols, simply increase the password length to compensate.

Export and store securely — use the CSV/JSON export to import directly into your password manager. Why:Storing passwords in plain text files or on sticky notes is a major security risk. Password managers encrypt your data, ensuring only you can access it.

Check for duplicates in batches — if the tool flags a duplicate in a batch, re-roll it immediately. Why:A duplicate in a batch is a password you're about to reuse — defeating the entire purpose of generating unique credentials for every account.

Clear your local history — history is stored in plaintext on your device; clear it regularly. Why:Anyone with access to your browser profile could read saved passwords. Treat local history like a temporary scratchpad, not a vault.

Frequently Asked Questions

A truly secure password has three properties:

Length — 16+ characters recommended in 2026. Every additional character makes brute-force attacks exponentially harder.
Complexity — A mix of uppercase, lowercase, digits, and symbols. It helps, but length matters most.
Uniqueness — Never reuse passwords across accounts. If one site is breached, all accounts sharing that password are compromised.

The most important factor is length. The generator creates long, complex, random passwords that meet all three criteria. Store them in a password manager so you only need to remember one master password.

Yes, absolutely. Generated passwords are designed to be unmemorable — that's what makes them secure. A password manager (Bitwarden, 1Password, KeePass) stores them encrypted behind a single master password, so you only need to remember one strong passphrase.

Without a password manager, people tend to reuse passwords across accounts, which defeats the purpose of generating unique ones. Modern browsers include built-in password managers, but dedicated tools offer cross-device sync, breach monitoring, and secure sharing.

This generator supports batch creation of up to 100 passwords per click — a deliberate limit designed to keep the browser responsive and make bulk review manageable.

If you need more, simply click Re-roll all or hit the Generate button again to produce another batch. For onboarding large numbers of accounts, generate several batches and combine the exported files, or import each CSV directly into your password manager.

The Company dropdown applies the typical password rules of popular sites — Google, Microsoft, Apple, Amazon, GitHub, Meta/Facebook, and PayPal — in a single click. Each preset sets the length, character types, and symbol set to values that site generally accepts.

Treat them as a sensible starting point, not a guarantee. Site policies change over time, so if a service rejects the result, tweak the controls below or pick a smaller symbol set and lengthen the password instead of dropping characters entirely.

Avoid ambiguous removes characters that are easy to confuse — such as I with l or 1, and O with 0. It's handy when you'll read the password aloud or type it into a small on-screen keyboard.

The Restrictions options prevent consecutive repeats (aa, 11), sequential patterns (abc, 123), and keyboard patterns (qwerty) for sites or policies that ban them. You can also exclude specific characters a site rejects using the Exclude characters field.

The export menu downloads your generated batch in one of three formats:

TXT — one password per line, plain text. Best for quick copy-paste workflows.
CSV — a Password column with each value quoted, ready to open in a spreadsheet or import into most password managers.
JSON — a structured array of strings, ideal for scripts, automation, or tooling that consumes the passwords programmatically.

All downloads happen entirely in your browser — nothing is uploaded to a server.

Not all sites accept the same symbols, so the generator lets you choose which set to draw from:

Standard (!@#$%) — accepted nearly everywhere.
Extended — a larger set for maximum entropy.
Minimal (!@#$) — for the most restrictive sites.
URL-safe — only characters that never need escaping in URLs.
Bash-safe — symbols that don't require shell escaping.
Custom… — type any exact set of symbols you want.

If a site rejects your password due to symbols, switch to a smaller set or define a custom one rather than dropping symbols entirely — length can compensate for the reduced pool.

When you generate more than one password at a time, the tool checks the whole batch for duplicates and shows a warning if any are found, along with a Re-roll duplicates button.

Clicking it re-generates only the duplicate entries, keeping every password in the batch unique. With a large character pool duplicates are rare, but with short lengths or a small character set (like PIN-only) they become possible — that's exactly when the warning matters, because reusing a password defeats the purpose of generating unique credentials for every account.

Your last 25 generated passwords are saved to your browser's localStorage under the key pwgen.history.v1 — they never leave your device. History keeps the primary password from each generation for quick re-copying.

Because history is stored in plaintext, clear it regularly using the Clear button in the history panel. It behaves like a temporary scratchpad, not a vault — a dedicated password manager remains the right home for your long-term credentials.