# Strong password generator

URL: https://shahid09.is-a.dev/tools/password-generator/
Author: Muhammad Shahid (https://shahid09.is-a.dev/)
Free tool · runs in your browser

Create strong random passwords on your own device, with the length and characters you choose.

**Quick answer:** A strong password is long and random. This tool picks every character with the browser's cryptographically secure random generator (crypto.getRandomValues), and nothing is sent or stored. Use at least 16 characters, a different password for every account, and a password manager to remember them.

## How to use it

1. **Choose the length.** From 8 to 64 characters; 16 or more is recommended.
2. **Choose the characters.** Uppercase, lowercase, numbers and symbols.
3. **Copy it into your password manager.** Generate a new one for every account.

## Frequently asked questions

### How long should a password be?

At least 16 characters for important accounts. Length adds more strength than extra symbols.

### Is it safe to generate passwords online?

With this tool, yes: the password is created in your browser with a secure random generator and never sent anywhere.

### Should I reuse a strong password?

No. If one site is breached, a reused password lets attackers into your other accounts.

### What makes a password strong?

Length and randomness. Avoid names, dates, words and patterns people choose.

### How do developers store passwords safely?

With a slow, salted password hash such as bcrypt, scrypt or Argon2, never plain text or a fast hash.

### What is a passphrase?

Several random words, such as maple-orbit-candle-river. Long passphrases are strong and easier to remember.

### How often should I change my password?

When there is a sign of a breach. Forced regular changes often lead people to choose weaker passwords.

### What is two-factor authentication?

A second step when you log in, such as a code from an authenticator app or a passkey. Turn it on for important accounts.

### What is a password manager?

An app that stores your passwords encrypted and fills them in for you, so you only need to remember one strong master password.

### What does bits of strength mean?

An estimate of how many guesses an attacker would need: each extra bit doubles it. 70 bits or more is strong, and 100 or more is very strong.

## Related

- [SHA-256 hash generator](https://shahid09.is-a.dev/tools/hash-generator/)
- [UUID generator](https://shahid09.is-a.dev/tools/uuid-generator/)
- [Fixing JWT session bugs](https://shahid09.is-a.dev/engineering/jwt-random-logouts-fix/)