Password Generator

The passwords people invent follow patterns — a name, a year, an exclamation mark — and attackers' tools know every one of them. A randomly generated password has no pattern to exploit: cracking it means trying the full space of possibilities, and that space grows astronomically with length and character variety. A 16-character password drawn from all four character sets has more combinations than there are atoms in a human body; at any realistic guessing rate, it is simply out of reach.

This generator uses your browser's cryptographically secure random number generator (the same Web Crypto API that underpins TLS), not the predictable Math.random() many casual tools rely on, and applies rejection sampling so every character is chosen with exactly equal probability. It also guarantees at least one character from each set you tick, since some sites insist on it. Generation happens entirely on your device — the password never travels over the network, is never logged, and disappears when you leave the page.

Two habits make generated passwords practical. First, use a password manager: the whole point of random passwords is that they're unmemorable, and a manager remembers them for you — one strong master password protects the rest. Second, never reuse a password across sites; breaches at one service are replayed against others within hours. Sixteen characters is a sound default; go longer for email and banking, which unlock everything else.