Randomantic How to use the random password generator
- Set your desired length — 16+ characters is recommended for most accounts.
- Choose which character types to include.
- Click Generate password, then Copy password to use it.
Why use a generated password?
Reused or predictable passwords are the single biggest cause of account takeovers — attackers don't need to "hack" you if your password is already leaked from another site or easy to guess. A random, unique password per account, ideally stored in a password manager, closes that door. This tool generates passwords locally using your browser's secure crypto API, so the password never leaves your device during generation.
Length beats complexity
Decades of "must contain a capital, a number and a symbol" rules trained people to produce
Password1! — which satisfies every requirement and is among the first things any
attacker tries. The arithmetic is not subtle: each extra character multiplies the search space,
while swapping an a for an @ barely changes it, because password-cracking
tools have substituted those characters automatically for years. A long random password is
strong; a short password decorated with symbols is theatre.
Practical targets: 16 characters for ordinary accounts, 20 or more for email, banking, and your password manager's own master password. Email deserves the longest one you have, because whoever controls your inbox can reset everything else.
Uniqueness matters more than strength
The most common way accounts are taken over is not cracking. It is credential stuffing: a site you signed up to years ago gets breached, and attackers replay that email and password pair against hundreds of other services automatically. If the password was reused, the strength of it was irrelevant — it was simply handed over.
This is why a different random password per site beats one memorable password everywhere, even a very good one. It also means that after any breach notification you only need to change one password rather than wonder which others are exposed.
You are not supposed to remember these
A 20-character random string is unmemorable by design, and that is the point — it means the password manager does the remembering. Use one. The browser's built-in manager is a reasonable starting point and vastly better than reuse; a dedicated manager adds cross-device sync and breach alerts. You then need to remember exactly two things: the master password, and the recovery method for it.
For the handful of secrets you genuinely must type from memory — the master password, a device login — a long passphrase of several unrelated random words is easier to recall than a random string and can be just as strong, provided the words were chosen randomly rather than by you.
Turn on a second factor
Even a perfect password is a single secret that can be phished. Two-factor authentication means a stolen password alone is not enough. An authenticator app or a hardware key is meaningfully better than SMS codes, which can be intercepted by SIM-swapping — but SMS is still far better than nothing, so switch it on wherever it is offered. Passkeys, where supported, remove the password from the equation entirely.
How these passwords are generated
Characters are drawn from your browser's cryptographically secure random source, the same facility used for real key material — not the general-purpose random function used by the games on this site. Generation happens entirely in the page: nothing is sent over the network, nothing is logged, and nothing is stored. Close the tab and the password is gone, so copy it into your password manager before you navigate away.
Need a short numeric code for a phone or padlock instead? Use the random PIN generator.