Generate a password
by length

For everyday accounts, 16 characters is the sweet spot recommended by most security professionals — it’s computationally uncrackable yet universally supported. Use 20+ for high-value accounts like email, banking and password-manager master passwords. Only drop to 8–12 when a site imposes a maximum length.

Up to a point. Each extra random character multiplies the number of possible passwords, so length is the single biggest factor in strength. But past about 16 characters you’re already beyond any realistic brute-force threat — the remaining risks are phishing and breaches, which length can’t fix. That’s what two-factor authentication is for.

Because strength depends on the character set too. A 12-character password using only lowercase letters is far weaker than 12 characters mixing uppercase, lowercase, numbers and symbols. Every generator here defaults to the full character set for maximum entropy per character.

Yes. Every password is generated in your browser with the Web Crypto API’s crypto.getRandomValues() — the same randomness that secures HTTPS. Nothing is transmitted, logged or stored. You can confirm it in your browser’s network tab.