How long should a password be?

Sixteen characters or more for anything that matters. Length beats complexity: a 20-character password of lowercase letters has more entropy than a 10-character one with every symbol class. For accounts you type by hand, four or five random words is both stronger and easier than a short scramble.

Is it safe to generate a password on a website?

It is safe here specifically because generation happens in your browser and the result is never sent anywhere — you can disconnect from the internet and it still works. Verify that claim yourself: open your network tab and watch that nothing is requested when you click generate.

Is the randomness actually random?

It uses crypto.getRandomValues, the browser's cryptographically secure random number generator, seeded by the operating system. Math.random is not suitable for passwords and is not used here.

Should I reuse a generated password?

Never. The value of a random password is destroyed by reuse — one breached site then exposes every account that shares it. Generate a different one per site and keep them in a password manager.

Password Generator

Generate a strong random password of any length, with control over uppercase, lowercase, digits and symbols. Randomness comes from the browser's crypto.getRandomValues — a cryptographically secure source, not Math.random. The password is created on your machine and never transmitted.

Runs in your browser — nothing is uploaded

Questions

How long should a password be?: Sixteen characters or more for anything that matters. Length beats complexity: a 20-character password of lowercase letters has more entropy than a 10-character one with every symbol class. For accounts you type by hand, four or five random words is both stronger and easier than a short scramble.
Is it safe to generate a password on a website?: It is safe here specifically because generation happens in your browser and the result is never sent anywhere — you can disconnect from the internet and it still works. Verify that claim yourself: open your network tab and watch that nothing is requested when you click generate.
Is the randomness actually random?: It uses crypto.getRandomValues, the browser's cryptographically secure random number generator, seeded by the operating system. Math.random is not suitable for passwords and is not used here.
Should I reuse a generated password?: Never. The value of a random password is destroyed by reuse — one breached site then exposes every account that shares it. Generate a different one per site and keep them in a password manager.

Password Generator

Questions

What people use next