Strong password generator
Create strong, random passwords locally in your browser. Choose length and character types; nothing is transmitted or stored.
20
How to use the strong password generator
- Set the length and which character types to include.
- Press Generate.
- Copy the password into your password manager.
What makes a password strong
Length and randomness, far more than swapping letters for symbols. A long random string is exponentially harder to crack. Aim for 16+ characters, use a unique password per account, and store them in a password manager. Prefer something memorable? Try the passphrase generator; want to check one? Use the strength tester.
Code & API examples
Use this from the command line or your code.
OpenSSL
openssl rand -base64 20/dev/urandom
LC_ALL=C tr -dc 'A-Za-z0-9!@#$%^&*' </dev/urandom | head -c 20; echoSee all endpoints at /api/tools/.
Frequently asked questions
Length and randomness. A long, random mix of character types is far harder to crack than a short complex one. Aim for 16+ characters or a long passphrase.
Yes — passwords are generated in your browser using the cryptographically secure random generator and never leave your device.
For a fully random password, 16 characters resists brute force for the foreseeable future; 20+ is sensible for high-value accounts. Length adds far more strength than swapping a few letters for symbols.
Yes. Reusing one password means a single breach exposes every account that shares it. Generate a unique random password per site and store them in a password manager.
They enlarge the character set, which raises the work needed per guessed character, but length matters more. A long all-letter passphrase can beat a short symbol-laden password.
It draws from the WebCrypto getRandomValues source built into your browser, which is designed to be unpredictable — unlike Math.random(), which is not safe for secrets.
It is when the generation happens locally, as it does here — nothing is sent over the network. Avoid generators that round-trip your password to a server.
You generally don't. Store random passwords in a password manager and only memorize one strong master passphrase plus your device unlock code.
Mostly none for security, but some systems reject spaces or specific symbols. If a site limits characters, increase length to compensate for the smaller set.
Only by guessing. A 16-character random password has so many combinations that brute force is infeasible — the real risks are phishing, reuse, and malware, not raw cracking.
Human-chosen passwords cluster around predictable patterns that cracking tools target first. Machine-random output has no pattern to exploit, which is exactly what makes it strong.
No — this tool only produces a string. You still have to set the new password on each account, which is when existing sessions may be invalidated.
Related tools
Want to hide your IP for real?
vpn.golf is a no-logs WireGuard VPN. Pick a hole, take the shot.
Step up to the tee — free