Generate a secure password

Generate a strong random password — pick the length and which character sets to include — produced with your browser's cryptographically secure randomness and never sent anywhere.

Open this example in Password Generator

Open the tool, then paste the sample input below. Everything runs locally in your browser.

Open this example in Password Generator →

The problem

A strong password should be long and random, not a memorable pattern. Generating one in the browser with secure randomness avoids weak choices and avoids the risk of a generator that sends the password to a server.

Sample input

Settings
length: 16
sets:   lowercase + uppercase + digits + symbols

Expected output

Example password
k7$Rm2!pXq9zT4@w

Illustrative only — each run produces a different password. A 16-character mix of all four sets is a strong default; longer is stronger.

How to do it

  1. Choose the password length.
  2. Select the character sets to include.
  3. Generate the password.
  4. Copy it into your password manager.
  5. Generate a fresh one for each account.

Common mistakes

  • Choosing a short length to make it memorable.
  • Reusing one generated password across accounts.
  • Excluding symbols where the site allows them.
  • Pasting the password into an untrusted page.
  • Relying on a non-cryptographic random source.

Related tools

Related guides

FAQ

What makes a password strong?

Length and randomness. A long password drawn at random from a large character set is far harder to guess or brute-force than a short memorable one.

How long should a password be?

At least 16 characters for important accounts, longer where allowed. Length adds more strength than adding complexity to a short password.

Is the password random and secure?

It is generated with the browser's cryptographically secure random source, not a predictable one, and it is never sent to a server.

Should I reuse a generated password?

No. Generate a unique password per account and store them in a password manager so a breach of one site does not expose the others.

Is the password uploaded?

No. Generation runs locally in your browser. The password is never sent anywhere.

Passwords are generated locally in your browser with secure randomness. Nothing is uploaded.

Explore more security and debugging tools

Generate passwords, hash and encode text, scan for secrets and decode tokens — grouped in one place.

View the security & debugging toolkit →

Practical example and expected result

Generate a strong random password - pick the length and which character sets to include - produced with your browser's cryptographically secure randomness and never sent anywhere. In practice, this is most useful when you need a quick, repeatable check on a developer artifact before adding it to a ticket, pull request, test fixture, or support note.

A realistic input for this workflow is length: 16 sets: lowercase + uppercase + digits + symbols. The expected result should resemble k7$Rm2!pXq9zT4@w, with the same important values preserved.

Troubleshooting checklist

  • Confirm you copied the complete developer artifact and not only a partial line or truncated preview.
  • Run the local tool once with a safe sample, then repeat with the real data only if your team policy allows it.
  • Check quoting, escaping, whitespace, encoding, timestamps, and environment-specific values before trusting the result.
  • Before sharing output, remove secrets, tokens, cookies, customer data, and production hostnames that are not needed for the review.

Next useful steps

Review checklist before sharing the result

For Generate a secure password, the safest workflow is to test with a small sample, confirm the output shape, then repeat with the real artifact only when needed. Keep the original input open until you verify that no value was dropped, decoded twice, sorted unexpectedly, or changed from text into a different type.

Before copying the result into a pull request, issue, chat thread, or support ticket, scan for private values. Replace real IDs, bearer tokens, session cookies, email addresses, internal hostnames, and customer data with placeholders. If another tool is listed above, use it as the second pass rather than manually editing complex output.

  • Keep one line of context explaining why the transformation was needed.
  • Preserve enough sample structure for a reviewer to reproduce the result locally.
  • Note any assumptions about encoding, timezone, delimiter, schema version, or runtime environment.