Secure Password Generator

A password is only as secure as the place it was created. This generator works entirely on your device, uses no third-party scripts, and keeps working with your internet connection switched off.

Strength: –

Choose between 4 and 128 characters.

Characters to include

Recent passwords

    What makes a password generator secure?

    Most articles talk about what makes a password strong. This page is about the tool. A generator can produce long random strings and still be unsafe if it sends them somewhere, leaks them to analytics, or uses weak randomness. Here is what we do, and what you should look for in any generator:

    • Client-side only. All code runs in your browser. There is no server-side endpoint that could receive a password — you can verify this in your browser’s developer tools (Network tab) while clicking Generate.
    • Cryptographic randomness. We use crypto.getRandomValues() with rejection sampling for a uniform distribution, never Math.random().
    • No third-party code. No ad networks, analytics tags, CDNs or web fonts are loaded. A strict Content-Security-Policy header blocks any script that is not served from this domain.
    • No persistence. Passwords are not written to cookies, localStorage or IndexedDB. Recent passwords live only in memory and vanish when you close the tab.
    • HTTPS with HSTS. The page is delivered over encrypted HTTPS with Strict-Transport-Security, so it cannot be tampered with in transit.

    How to use it as securely as possible

    1. Load this page, then optionally disconnect from the internet. Generation keeps working.
    2. Generate the password and paste it straight into your password manager or the sign-up form.
    3. Clear your clipboard afterwards (copy something else) on shared computers.
    4. Close the tab to wipe the session history.

    Option: don’t start with a number

    Some legacy systems, LDAP directories and command-line tools treat a leading digit specially, or reject passwords that start with one. Tick Don’t start with a number to avoid that. It removes a tiny amount of entropy — less than one bit — which is irrelevant at 16 characters.

    Secure passwords for teams and IT

    Admins provisioning many accounts can use the bulk password generator to create up to 1,000 unique passwords and download them as a text file — still generated locally. For one-time onboarding credentials that users will change at first login, see the temporary password generator.

    Last updated: · Reviewed by the Password Generator team

    Frequently asked questions

    Do you store or log the passwords I generate?

    No. There is no code path that sends a password anywhere, and the site sets no analytics or tracking cookies. Passwords exist only in your browser’s memory until you close the tab.

    Can I use this password generator offline?

    Yes. Once the page has loaded, generating, copying and checking strength all work without an internet connection.

    Is an online password generator less secure than an app?

    Not if it runs entirely client-side with secure randomness and no third-party scripts, as this one does. The browser’s Web Crypto API uses the same operating-system random source that native apps use.

    How can I verify nothing is sent?

    Open your browser’s developer tools, switch to the Network tab, and click Generate a few times. You will see no requests at all.

    Related tools