How this generator works
Every character is chosen using crypto.getRandomValues(), the Web Crypto API's cryptographically secure random number generator — the same source used to generate encryption keys. Nothing about the password ever leaves your browser; there is no server request involved in generating it.
What makes a password strong?
Password strength comes down to entropy — how many possible passwords could have been generated with the same length and character set. A longer password with a larger character set (numbers, upper/lowercase, symbols) has more possible combinations, making it harder to guess or brute-force. This tool shows the entropy in bits: each additional bit doubles the number of possible passwords.
How long should a password be?
Current guidance (NIST SP 800-63B) recommends at least 12-16 characters for important accounts, longer where the site allows it. Length matters more than complexity — a 20-character password using only lowercase letters is harder to brute-force than an 8-character password using every character type. Use the length buttons above for a quick start:
- 8 characters — the minimum many older sites still require; avoid this length if the site allows anything longer.
- 12 characters — a reasonable floor for most accounts today.
- 14-16 characters — a comfortable, widely-recommended range for anything important (banking, email, password manager master passwords).
- 20+ characters — a solid choice wherever the site's field allows it, with no real downside besides typing it out on a device without a password manager.
Should I include symbols?
Symbols increase the character set size (and therefore entropy per character), but some older systems still reject certain symbols or limit password length. If a site's password field rejects your generated password, uncheck symbols and try a longer length instead — length compensates for a smaller character set.
Password generator vs. passphrase generator
This tool generates random-character passwords — a string drawn from letters, numbers, and symbols, like the ones above. A passphrase generator is a different approach: it strings together several random dictionary words (e.g. correct-horse-battery-staple) into something easier to read, say, and type on a phone keyboard, at the cost of needing more words to reach the same entropy as a shorter random-character password. Both are valid — a password manager makes the readability advantage of passphrases mostly moot, since you're copy-pasting either way.
Frequently asked questions
Is this password generator secure?
Yes — it uses the Web Crypto API's crypto.getRandomValues(), a cryptographically secure random number generator, not Math.random() (which is not safe for security-sensitive values). Generation happens entirely in your browser; the password is never transmitted anywhere.
Does Pingfloat store the passwords I generate?
No. There is no server request involved in generating a password — it's created and displayed entirely client-side in your browser, and nothing is logged or stored.
What's a good password length — 12, 15, or 20 characters?
Any of those are solid choices. 12 characters is a reasonable minimum for most accounts; 15-16 is a comfortable, widely-recommended range for anything important; 20 or more is a good choice wherever a site allows it, especially if you're using a password manager to store it. This tool defaults to 25 characters, and the preset buttons above jump straight to the most commonly needed lengths.
Is "password creator" the same as a password generator?
Yes — "password creator" and "password generator" describe the same thing: a tool that creates a random password for you, rather than one you think up yourself.
Why does my generated password sometimes look similar to the last one?
It doesn't, structurally — each character is chosen independently and the result is shuffled, so any apparent similarity between two generated passwords is coincidental, not a pattern in the generator.