16-character password generator
Sixteen characters is the length most security guidance recommends today: with uppercase, lowercase, digits and symbols it gives about 100 bits of entropy, far beyond what password crackers can brute-force, while still fitting the limits of almost every website. This page presets that length; the strength estimate under the list shows how long an attacker would need.
●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●
Checked on your device with zxcvbn (dictionary words, patterns, dates), loaded only when you type here. Nothing is sent.
Passwords come from your browser's cryptographic random generator (Web Crypto). They exist only on your screen until you leave the page.
Tips
- Store the password in a password manager instead of memorising it; let the manager fill it in.
- If a site rejects symbols, untick Symbols and increase the length to 20 to keep the same strength.
- Never reuse a generated password across sites; generate a fresh one for each account.
Why it is private
Everything you type or drop here is handled by your browser, on your device. Nothing is uploaded. To verify, open your browser's developer tools, go to the Network tab, and use the tool: you will see no request carrying your data.
Frequently asked questions
- Is 16 characters enough for a bank?
- Yes, when random. The weak point is reuse and phishing, not length.
- Are the passwords sent to a server?
- No. Generation runs on your device; no request carries the password.