Password Generator

Yes. This tool uses the browser's built-in crypto.getRandomValues() API to generate passwords — the same cryptographically secure randomness used in professional security software. Your generated passwords are never sent to any server, never logged, and never leave your device. The entire process happens locally in your browser.

Two main factors: length and unpredictability. Length is the bigger lever — every extra character exponentially increases the number of possible combinations. Unpredictability means the password shouldn't contain real words, names, dates, keyboard patterns like qwerty, or repeated sequences. A good minimum for anything important is 16 characters using a mix of uppercase, lowercase, numbers, and symbols.

Passphrases — random word combinations like correct-horse-battery-staple — are a legitimate and increasingly recommended alternative, particularly for master passwords you need to memorize. They're longer, genuinely random (when words are chosen randomly, not personally), and easier to remember. For passwords you'll store in a manager, random character passwords are still a solid choice.

You don't have to. Use a password manager — Bitwarden (free and open source), 1Password, or Dashlane are all well-regarded options. You only need to remember one strong master password for the manager itself, and it generates, stores, and autofills everything else for you. This is the approach security professionals actually use.

Ambiguous characters are ones that look visually similar to each other and are easy to confuse when reading or typing: 0 and O (zero and the letter O), 1, l, and I (the number one, lowercase L, and uppercase i). Enabling this option removes these characters entirely, which is useful if you'll ever need to type the password manually rather than copy-pasting it.

Pronounceable mode generates passwords by alternating consonants and vowels, producing nonsense syllables that are easier to read aloud and type from memory — for example bativone or kelumosi. This makes the password weaker per character than a fully random one, so you should increase the length to compensate. It's a useful option for temporary passwords or situations where someone else needs to type it themselves.

For accounts you store in a password manager: 20+ characters, fully random, all character types. For a master password you need to memorize: either a 6-word random passphrase, or at minimum 16 characters that you've genuinely memorized rather than written down. For throwaway accounts: at least 12 characters. The absolute minimum for anything you care about is 12 characters — anything shorter with modern GPU cracking speeds is too easily brute-forced given enough time.