A strong password is long, unique to each account, and drawn from a wide range of character types so it can't be guessed or found in a dictionary. This tool generates one using the browser's cryptographically secure random number generator (crypto.getRandomValues) — nothing is sent to a server, and nothing is stored.
Longer passwords are exponentially harder to brute-force than adding more character types: a 16+ character password is a reasonable default for most accounts, and a password manager means you never have to remember it.
How random are the generated passwords?
This tool uses the Web Crypto API's cryptographically secure random number generator (crypto.getRandomValues), not Math.random(), so output is suitable for real password use.
What length and character sets should I use?
For most accounts, 16+ characters mixing upper/lowercase, digits, and symbols gives strong resistance to brute-force attacks — longer is generally better than more complex character rules.
Are generated passwords stored or transmitted?
No — everything happens locally in your browser; nothing is logged, saved, or sent to a server.