Generate a password worth trusting.

Strong passwords and passphrases, generated in your browser and measured honestly — in bits of entropy, not marketing labels.

Generated on your device · never sent, stored or logged · works offline

Length20

Lowercase (a-z)Uppercase (A-Z)Numbers (0-9)SymbolsExclude look-alike charactersDrops O/0 and I/l/1 — for passwords you must read aloud or retype.No repeated charactersSlightly lowers entropy — the figure above already accounts for it.No runs like abc or 321

Also exclude these characters

Generate several at once

How this generator works

Every value is produced by your own browser. Loading this page fetches its code, as any page does; after that, generating costs no network traffic at all, and we switch our own analytics off on this page. Disconnect from the network and it still works.
Randomness comes from your operating system through the Web Crypto API. If a browser cannot supply it, this page refuses to generate rather than quietly falling back to a predictable source.
Characters are drawn with rejection sampling, which avoids the modulo bias that subtly skews many generators toward part of the alphabet.
The strength figure is computed from the options you chose, not guessed by inspecting the text. Constraints that shrink the search space, such as banning repeats, lower the reported number honestly.
Nothing is written to your browser storage or history. Reload the page and every value here is gone.

Getting real value from it

Use a password manager and let it hold these. A unique password per site is what actually limits the damage of a breach, and no one can memorise dozens of them.
Pick a passphrase for the handful you must type by hand — a device login, or the manager’s own master password. Length beats punctuation.
Never reuse one. Attackers replay credentials from one breach against every other service, which is why a strong but reused password still fails.
Add multi-factor authentication where it is offered. A stolen password alone then is not enough to get in.
Do not rotate on a schedule for its own sake. Change a password when there is a reason to believe it was exposed; routine forced changes push people toward predictable variations.