Password Generator

How to Create Passwords That Actually Hold Up

A password is only as good as how hard it is to guess. Attackers rarely sit at a login screen typing guesses by hand. Instead they run automated programs that test millions or billions of combinations against leaked databases or live services. The question that matters is simple: how many guesses would it take, on average, before the program lands on yours? This generator builds passwords designed to push that number far beyond what any practical attack can reach, and it does the whole job inside your browser so the result never travels across the internet.

Length Beats Cleverness

When people try to make a password "strong," they usually reach for tricks: swapping an "a" for "@", adding a "!" at the end, capitalising the first letter. Those tricks help a little, but they are predictable, and the programs that crack passwords already know every one of them. What genuinely defeats a brute-force attack is length. Each extra character multiplies the number of possible combinations, so the difficulty grows exponentially rather than little by little.

Think of it this way: a short password drawn from a big alphabet still has relatively few possible arrangements, while each additional independently selected character multiplies the search space. The slider runs from 6 to 32 only to accommodate destination rules; six characters is not a recommendation. Current NIST SP 800-63B-4 sets verifier-side minimums of 15 characters for password-only authentication and permits 8 when the password is used within multi-factor authentication. For a generated value stored by a manager, use 20 or more whenever the destination accepts it.

Understanding "Entropy" Without the Maths

You will often see password strength described in terms of entropy, measured in bits. You do not need the formula to use the idea. Entropy is just a way of counting how many equally likely passwords a generator could have produced. More bits means a bigger haystack for the attacker to search through, and every extra bit roughly doubles that haystack. Two things raise entropy: making the password longer, and drawing each character from a larger pool. That is exactly what the character-type checkboxes control. Turning on uppercase letters, lowercase letters, numbers, and symbols together gives every position dozens of possible values instead of just a handful, so a fully random 16-character mix is dramatically harder to crack than a 16-character string of only lowercase letters.

Why Generating It Here Is Safer

Every password on this page is assembled by JavaScript running on your own device. Nothing you generate is uploaded, logged, or stored on a server, because there is no server step at all. When you close the tab, the passwords are gone unless you copied them somewhere yourself. That matters because the moment a fresh password is transmitted or saved to someone else's system, it becomes something that can be intercepted or leaked. A password you never sent anywhere cannot be stolen in transit. The advanced options also let you exclude visually similar characters such as the lowercase L, the number 1, the capital O and the number 0, which is useful when you may need to read a password aloud or type it from a screen onto another device.

When You Need a Passphrase Instead

A passphrase can be easier to type and remember, but this page does not generate one: it has no word list and makes no passphrase-entropy claim. Use a dedicated generator that discloses its word-list source and size, chooses each word independently with a cryptographic random source, and reports the resulting entropy. A phrase you invent or quote is not equivalent to randomly selected words.

Use a Password Manager and Never Reuse

The single most damaging habit in personal security is reusing one password across many sites. When any one of those sites suffers a breach, attackers take the leaked email-and-password pairs and try them everywhere else, a technique called credential stuffing. One leak then unlocks your email, your shopping accounts and possibly your bank. The fix is to give every account its own unique password, and the practical way to manage hundreds of unique passwords is a dedicated password manager. A reputable manager encrypts your vault, fills passwords in for you, and can hold the long random strings this generator produces so you never have to remember them. Generate a password here, copy it with the Copy button, and paste it straight into a new entry in your manager.

How Often Should You Change Them?

NIST's current verifier guidance says passwords should not be changed periodically unless there is evidence the authenticator was compromised. Change a value after a breach notice, suspected exposure, reuse discovery or entry on an untrusted device; do not rely on calendar rotation as a substitute for unique passwords and multi-factor authentication.

Common Mistakes to Avoid

• Building passwords from personal facts: names, birthdays, pet names and addresses are the first things an attacker tries.
• Relying on keyboard patterns: sequences like "qwerty" or "123456" feel random but are in every cracking dictionary.
• Storing passwords in a plain document or sticky note: a text file or note can be read by anyone with access to the device.
• Reusing a "base" password with small tweaks: if one is exposed, the pattern gives the rest away.
• Choosing too short for the sake of convenience: a memorable six-character password offers little real protection for an important account.

How It Works in Your Browser

This tool is a self-contained page. The character sets, the length and option controls, and the strength meter all run as code on your device. When you click Generate, your browser picks characters from the pools you selected, optionally guarantees at least one of each chosen type, shuffles the result, and shows it on screen. No account, no sign-up and no upload is involved at any point. Because the work happens locally, the generator stays fast and keeps functioning even if your connection drops, and your generated passwords are never shared with QuickMerge or anyone else.

Next steps