Generate strong, random passwords in your browser using your device's cryptographic random source. Nothing is generated on or sent to a server.
A strong password is long and random. Length matters more than complexity: a longer password is exponentially harder to guess, and randomness stops it being predictable. This tool generates passwords in your browser using your device's cryptographic random source, so the result is genuinely unpredictable and never leaves your machine.
A 20-character password made of random letters is far stronger than an 8-character password with symbols and numbers crammed in. Every extra character multiplies the number of possible passwords, so if you can only remember one rule, make it "longer".
The strength readout shows entropy in bits, which is the honest measure. Above about 70 bits is strong enough that brute force is not a realistic threat.
The best password is one you never see and never type. A password manager generates a different long random password for every account and fills it in for you, so a leak of one site cannot be reused against another. Generating passwords by hand is useful, but a manager is what makes strong, unique passwords practical across dozens of accounts.
Yes. They come from crypto.getRandomValues, your browser's cryptographic random source, not the predictable Math.random. Nothing is generated on or sent to a server.
At least 16 characters for important accounts, longer if the site allows it. Length is the single biggest factor in strength.
On this one, yes, because generation happens entirely in your browser and nothing is transmitted. Be wary of tools that generate passwords server-side, since the server sees the result.
No. A unique password per site is what limits the damage when one site is breached. A password manager makes that practical.