Since 2001
Secure passwords, instantly.
Secure passwords for your sign-ins — generated in your browser, with nothing stored or transmitted.
Length: 16
Frequently asked questions
No. The generator runs entirely in your browser and uses your device's Web Crypto API. The result never leaves the page: it is not logged, not stored and not sent to a server. The optional REST API logs no generated values either.
Every character is drawn through crypto.getRandomValues(), the browser's cryptographically secure random source. Selection uses rejection sampling rather than a modulo operation, so every character in the chosen set is exactly equally likely.
With upper and lower case letters, digits and symbols, 16 characters is a good target — a little over 100 bits of entropy. A passphrase reaches a comparable level with five to six random words. Do not go below 12 characters.
Entropy is the base-2 logarithm of how many results were equally likely. Each additional bit doubles the work for an attacker. From around 60 bits, guessing through a login form is hopeless; from 80 bits, so is working through stolen password hashes.
Yes. After a breach, attackers replay the stolen credentials against other services automatically. A unique password per account confines the damage to that single service — a password manager makes this practical.