Since 2001
Secure passwords, instantly.
Secure passwords for your sign-ins — generated in your browser, with nothing stored or transmitted.
Length: 16
Generated locally in your browser: the password never leaves your device. How to verify this
Frequently asked questions
No. The generator runs entirely in your browser and uses your device's Web Crypto API. The result never leaves the page: it is not logged, not stored and not sent to a server. The optional REST API logs no generated values either.
Every character is drawn through crypto.getRandomValues(), the browser's cryptographically secure random source. Selection uses rejection sampling rather than a modulo operation, so every character in the chosen set is exactly equally likely.
With upper and lower case letters, digits and symbols, 16 characters is a good target — a little over 100 bits of entropy. A passphrase reaches a comparable level with five to six random words. Do not go below 12 characters.
Entropy is the base-2 logarithm of how many results were equally likely. Each additional bit doubles the work for an attacker. From around 60 bits, guessing through a login form is hopeless; from 80 bits, so is working through stolen password hashes.
Yes. After a breach, attackers replay the stolen credentials against other services automatically. A unique password per account confines the damage to that single service — a password manager makes this practical.