Free Tool · Password Security

Generate a Strong, Unique Password

Written by James Batt CISSP · CEH · Last reviewed 10 September 2026

Set the length, hit generate, and you have a password nobody is going to guess. You are never going to remember this one — and you shouldn’t try.

This is the one place where symbols and capitals genuinely earn their keep. When a machine picks the characters at random, the extra complexity costs you nothing, so take it. It only becomes bad advice when a person is inventing the password themselves, because what people actually produce under those rules is Password123!

The reason to use a different one everywhere: when some website you’d half forgotten about gets breached, criminals take the email addresses and passwords from it and try the same pairs, automatically, on hundreds of other sites — your email, your bank, your Microsoft 365. One password re-used is one breach away from all of them.

Got a password already in mind? Run it through the password strength checker first.

The generator is just below

At a glance

Made in your browser — the password is never sent anywhere or stored

No email address required, and nothing to sign up for

Nothing to install — it works on any phone or computer

Generate as many as you like — one for every account

Make a password

Choose how long and what to include, then generate. The password is made by your own browser using its built-in cryptographic random number generator — it is never sent anywhere, never stored, and nobody else ever sees it, including us.

Your password

Press Generate to make one

Settings

Length

20

Capital letters A–Z Small letters a–z Numbers 0–9 Symbols ! @ # $ % & * Leave out lookalike characters 0 O 1 l I |

What to do with it

Put it straight into a password manager. That is the whole point — you are not meant to remember this, and writing it on paper by the screen defeats it.
Use a different one for every account. This matters more than length. One breach at one website hands an attacker every account sharing that password.
Longer costs you nothing here. A machine is doing the typing into your manager, so twenty characters is no more effort than twelve.
Leave out lookalikes only if you will type it by hand. On a WiFi password read off a card it saves arguments. Everywhere else it slightly weakens the password for no gain.
Turn on two-step sign-in as well. Even a perfect password can be phished. The second step is what saves you when it is.

Rolling this out across a business?

Getting a team onto a password manager is less about the software and more about the week afterwards. I have done it enough times to know where people get stuck.

Talk to James

How this works. The password is generated in your browser by crypto.getRandomValues, the same cryptographic random source used for encryption keys, and characters are drawn so that every one in the set is equally likely. Nothing is transmitted, logged or stored, and closing this page is enough to be rid of it. The time estimate assumes an attacker guessing offline at about a trillion attempts a second — reviewed September 2026, and it gets shorter every year.

Who wrote this

James Batt

CISSP CEH Founder, Systems Secure

Twenty-five years as an IT architect in the oil and gas industry, designing multi-million pound systems for companies around the world, before going independent. These days the work is smaller and a good deal more useful: helping UK businesses get enterprise-grade security without an enterprise budget.

If you already use a password manager, use the generator built into it rather than this one. The password is made and stored in the same place, it never goes near your clipboard, and there is one less piece of code to take on trust. That is the right answer and I would rather say it than pretend otherwise.

This page is here for the times that doesn’t apply — a WiFi password going on a card, a router or a device you type by hand, or simply seeing what a decent password looks like when nobody has ever shown you one. It runs entirely in your own browser: nothing is sent anywhere, and if you want to prove that rather than take my word for it, disconnect from the internet once the page has loaded and it will carry on working.

If you want a second opinion on how your business handles passwords — or simply whether the password manager you are already paying for is set up properly — pick up the phone, or get in touch whichever way suits you.