Password Generator
Generate strong, cryptographically random passwords with customizable length, character sets, and easy-to-read mode. Nothing leaves your browser cache.
Choose length and character types
Longer is stronger. 16+ is recommended for most accounts.
Click generate
Uses PHP random_int (cryptographically secure).
Copy and use
Always store in a password manager, never in plain text.
Generate password
✓ Your password is ready
Cryptographically random, generated in this browser session. Refresh to discard.
8RT{Az.@d5JPBI|A
Store this in a password manager like Bitwarden, 1Password, or KeePass. Never email it or save in plain text.
How to choose a strong password
A strong password is the difference between a hacked account and a safe one. Modern brute-force attacks can guess 8-character passwords in minutes. 16-character random passwords would take centuries — even with the world's fastest hardware.
The 5 rules of password strength
- Length beats complexity. A 20-character password of lowercase letters is harder to crack than an 8-character one with symbols.
- Random is essential. Words from the dictionary, names, dates — all are tried first by attackers.
- Different password per site. If one site gets breached, attackers try the same password elsewhere.
- Use a password manager. Humans cannot remember 50 unique 20-character passwords. Software can.
- Enable 2FA wherever possible. Even a strong password is one breach away from being public.
Good vs bad passwords
password123
In every breach list since 2009.MyName1990!
Personal info + common pattern. Easily guessed.L9$kR2#mP8nQ4!vT
16 chars, mixed case, digits, symbols.correct-horse-battery-staple
4 random words. Long and memorable. xkcd-style.Frequently asked questions
Is the generated password stored anywhere?
No. Passwords are generated by PHP on our server, sent to your browser, and never stored or logged. Refresh the page and the password is gone.
How does PHP random_int compare to JavaScript Math.random?
random_int is cryptographically secure (CSPRNG). Math.random is not — never use it for security. This tool uses random_int.
What length is recommended in 2026?
Minimum 12 characters. Recommended 16. Banking and admin accounts: 20+.
Why exclude ambiguous characters?
Confusable characters (0/O, 1/l/I) cause errors when typing passwords from paper or another screen. Worth excluding when you must type, not paste.
Should I memorize the password?
No. Even strong passwords are useless if you reuse them. Use a password manager and only memorize the master password.