Password generator

Password generator is a free tool that creates random passwords at a chosen length using the character groups you select.

What makes a password strong?

Length and randomness make a password strong, with length generally helping more than predictable complexity tricks. Substituting an at sign for an "a", adding "123" or putting an exclamation mark at the end rarely adds much protection because password-cracking software checks common patterns.

A longer randomly generated password gives an attacker more possible combinations to try. Crack-time estimates are only illustrations, since the actual time depends on the password, the system's security controls, the attacker's hardware and whether the password database was protected properly. There is no single accurate crack time for every situation.

Password reuse is a common everyday risk. If one service suffers a data breach, attackers may try the exposed email address and password on email providers, shopping accounts and social networks. Every account should therefore have its own password.

A passphrase made from several randomly selected words is a legitimate alternative where you need to type or remember the secret. It should be long, unpredictable and unique. This tool creates character-based passwords rather than word-based passphrases.

How do I use the password generator?

Choose a length under Characters, select the character groups that the receiving service permits, then generate the password and copy it accurately.

1. Set a suitably long character count. The source allows a maximum of 2,048 characters, although target services may have lower limits.
2. Use Include lowercase characters and Include UPPERCASE characters unless the account has a reason to exclude either group.
3. Select Include numbers and Include symbols when the service accepts them.
4. Check the site's password rules before saving the result. Some forms impose their own minimum, maximum or required character types.
5. Store the finished password in a password manager and test the sign-in before closing an account setup or password-change page.

The generator uses PHP's random_int function, which is intended for cryptographically secure random selection. This distinguishes password generation from non-cryptographic pseudorandom generation.

What do the character settings mean?

The settings control which broad character groups can be used to build the generated password. Select at least one group, and check the finished result against any password policy that requires a particular type of character.

• Include numbers permits digits such as 0 to 9.
• Include symbols permits punctuation or special characters from the generator's symbol set.
• Include lowercase characters permits lower-case letters.
• Include UPPERCASE characters permits capital letters.

For example, a length of 20 with lower-case, upper-case, numbers and symbols selected produces a random 20-character password drawn from the enabled groups.

There is no free-text field for words, names or existing passwords, so spaces, accented letters and non-Latin scripts are not supplied as input. Do not assume that every website accepts every generated symbol. If a form rejects the result, follow that form's stated rules rather than repeatedly editing a strong password into a memorable pattern.

Privacy and server-side generation

Password generation happens on the server. Your selected settings travel to the server over HTTPS and are not stored. It would be incorrect to say that the work stays entirely on your device.

HTTPS protects information while it travels between the browser and server, provided the connection is valid. A compromised device is a separate endpoint risk and may expose data before encryption or after decryption. Avoid generating or handling account passwords on a shared computer, an unattended screen or a device that may contain malware. No online generator can protect a password after it has been copied into an insecure application or exposed through the clipboard.

How should I store a generated password?

Store a generated password in a reputable password manager rather than a notes file, spreadsheet, email draft or document labelled with the account name. A password manager keeps each account's credentials together, can fill long random passwords and reduces the temptation to reuse one password.

For an email account, online banking login, Microsoft 365 account or router administration page, save the exact site address alongside the credential. This helps avoid entering the password into a lookalike phishing page. Enable multi-factor authentication where the service supports it, preferably using an authenticator app or a security key where its configuration and user verification supply another factor. Passkey sign-in is a separate option and is not necessarily multi-factor.

Keep the password manager's recovery information somewhere secure. A long generated password is of little use if an account holder loses both the saved credential and the available recovery method. The Password strength checker can help assess an existing password, but do not treat a strength score as proof that a reused or exposed password is safe.

Common password generation mistakes

• Generating one strong password and reusing it across several accounts.
• Shortening the output because it looks inconvenient to type.
• Changing several random characters into a name, date or keyboard pattern.
• Saving passwords in an unprotected notes file or sending them to yourself by email.
• Ignoring a website's maximum length or permitted-symbol rules.
• Assuming complexity alone compensates for a short password.

No generator can prevent phishing, malware, account-recovery attacks or a service from storing passwords badly. Use a unique generated password as one part of account security, alongside software updates, multi-factor authentication and careful handling of recovery codes.

Frequently asked questions

Can a website reject a randomly generated password?

Yes. Websites can impose maximum lengths, ban certain symbols or require at least one character from named groups. Read the validation message carefully and generate another compatible password rather than trimming characters without checking the final length.

Should I change a strong password regularly?

Routine changes are usually unnecessary unless an employer or service requires them. Change the password promptly if it appears in a breach, has been shared, was entered on a suspicious page or may have been exposed on a compromised device.

Is a 2,048-character password practical?

Usually no. Although the generator's upper limit is 2,048 characters, the target service or storage software may enforce a lower limit. Choose a long password that the target service accepts and that your password manager can store and fill reliably.

Can I use a generated password for Wi-Fi?

Yes, provided the router and connecting devices accept its length and characters. Very long passwords or awkward symbols can be inconvenient when entering credentials on televisions, printers and games consoles, so check compatibility before updating every device.

Could the generator produce the same password twice?

A collision is theoretically possible because random generation always has a finite set of outputs. With a sufficiently long password and a broad character set, accidental duplication is not a practical everyday concern. Still, save each credential against the correct account and check the entry before relying on it.