Random passwords made in your browser with its cryptographic generator. Nothing is sent to us, and nothing is stored.
Each password is drawn in your browser from crypto.getRandomValues,
the cryptographically strong random source of the Web Crypto API. The page
never sends a password anywhere. The form has no submit action and the fields
have no names, so there is nothing for a server to receive. You can load the
page, disconnect from the network and it will still work.
Two details matter for quality. Characters are picked so that each one is equally likely, by discarding random values that would favor some characters. And when you ask for several kinds of character, a password missing one kind is thrown away and drawn again, which keeps every allowed password as likely as any other.
Strength comes from length and randomness. The figure shown under the passwords is entropy: the length multiplied by the number of bits each character carries. A random 20 character password from letters, digits and symbols carries about 128 bits, which is beyond guessing by any means. Sixteen characters is a sound floor for anything a password manager types for you.
NIST's digital identity guidance (SP 800-63B) says the same thing from the other side: length matters more than forcing a mix of character types, and passwords should not be changed on a schedule, only when there is reason to think one has leaked. If your organization still enforces 90 day changes, that rule is worth revisiting in your access control policy.
Use a different password for every account and keep them in a password manager. Reuse is what turns one site's breach into many. Turn on multi-factor authentication wherever it is offered, because a strong password does nothing against a convincing phishing page.
The option to leave out look-alike characters removes I, l, 1, O, 0 and o. Use it for a password someone will read aloud or type from paper, such as a Wi-Fi key or a first-login password. It costs a little strength, which one extra character more than repays.
Only one that makes the password on your own device. This one does: the password is created by your browser and is never sent to our server. You can confirm it by loading the page and switching off your network before generating.
Sixteen random characters or more for anything stored in a password manager. For a password you must remember and type, a longer passphrase of several unrelated words is easier to live with.
Symbols add a little strength per character, and length adds more. A longer password without symbols is stronger than a short one with them. Include symbols when a site demands them.
It measures how many guesses a random password could need: each extra bit doubles the number. It applies only to passwords chosen at random, like these. A password a person invents has far less than its length suggests.
No. They exist only in the page in front of you and are gone when you close or reload it. Copy the one you want into your password manager.