Password Generator
Create a random password with the length and characters you choose. Passwords are generated on your device with your browser’s cryptographic random number generator and are never sent anywhere.
4–128 characters. 16 or more is a good default.
Long and random. Store it in a password manager rather than trying to memorise it.
- Use a different password for every account.
- Save it in a password manager, and turn on two-factor authentication where you can.
- The estimate assumes the password is random, like this one. No password is impossible to crack.
Passwords are created on this device with your browser’s cryptographic random number generator (crypto.getRandomValues). They are never sent anywhere or stored.
How to Use the Password Generator
- Set the password length with the slider or the number box. 16 characters or more is a sensible default.
- Choose which characters to include: uppercase letters, lowercase letters, numbers and symbols.
- Press Generate password. If you change a setting afterwards, a new password is created straight away.
- Check the estimated strength, then copy the password into your password manager or the sign-up form.
Examples
16 characters, all character types
- Input
- Length 16 · A–Z, a–z, 0–9, symbols
- Output
- Example: q7#Vx2!mT9@kLp4$ Estimated strength: Very strong (≈ 103 bits)
A 6-digit PIN
- Input
- Length 6 · numbers only
- Output
- Example: 480153 Estimated strength: Weak (≈ 20 bits)
About the Password Generator
A good password is long, random and used for only one account. People are not good at being random: we reuse words, names, dates and keyboard patterns, and password-cracking tools try those first. Letting a generator pick the characters gives you a password with no pattern to guess.
This generator uses crypto.getRandomValues, the cryptographically secure random number generator built into your browser, with rejection sampling so every character is equally likely. When you select several character types, the password always includes at least one character from each, which is what most sign-up forms require.
The strength meter estimates entropy: the length multiplied by log2 of the number of possible characters. It describes how hard the password would be to guess by brute force, even for someone who knows how it was made. It cannot protect against a password being stolen through phishing, malware or a website data breach, which is why unique passwords and two-factor authentication still matter.
Everything happens in your browser. Passwords are not sent to Usevanta, saved or logged, and they are gone when you reset or leave the page.
Frequently Asked Questions
Is it safe to use an online password generator?
It depends on how the generator works. This one creates passwords locally with your browser’s cryptographic random number generator, and the password is never transmitted or stored. Once the page has loaded it works without an internet connection.
How long should my password be?
For most online accounts, 14 to 16 random characters is plenty. Use 20 or more for your most important accounts, such as your email or the master password of a password manager.
Should I include symbols?
Symbols increase the number of possible characters, so each character adds more strength. Some websites reject certain symbols. If a site refuses the password, turn symbols off and add a few more characters of length instead.
Does “Very strong” mean the password cannot be hacked?
No. The rating only estimates how hard the password is to guess. Any password can still be exposed by phishing, malware or a breach at the website that stores it. Use a different password for every site and turn on two-factor authentication where you can.
Where should I keep generated passwords?
In a password manager, which can create, store and fill in passwords for you across devices. Avoid saving them in plain text files, notes apps or emails.
Related Tools
All developer tools →Generate secure random UUID v4 identifiers in your browser.
Generate random whole numbers in any range, with or without duplicates.
Encode text to Base64 or decode Base64 back to readable text.
Count characters with and without spaces while you type.