How this password generator works
The generator builds passwords from a cryptographically secure random source in your browser, not from Math.random. You choose the length and which character classes to include: lower case, upper case, digits and symbols.
Longer beats complicated
Strength comes from length far more than from exotic symbols. A long passphrase of random words is both stronger and easier to remember than a short string of punctuation. Where a service allows it, prefer 20 characters or more.
Generating a password here is only half the job: store it in a password manager rather than reusing it, and turn on two-factor authentication where you can.
Frequently asked questions
Is this generator actually random?
Yes. It uses the Web Crypto API (crypto.getRandomValues), the same cryptographically secure source browsers use for TLS, rather than the predictable Math.random.
How long should my password be?
Sixteen characters is a reasonable modern minimum for a random password, and 20 or more is better. Length adds strength exponentially, so adding characters helps far more than adding symbol types.
Is the password sent anywhere?
No. Generation happens entirely in your browser and nothing is transmitted or logged, which you can verify in the DevTools Network tab.
Should I use the generated password directly on a website?
Yes, but paste it into a password manager first so it is saved and you can retrieve it. A strong password you cannot remember and did not store is useless.