Password generator

What makes a good password?

A strong password is long, random and unique. Length matters most: each extra character multiplies the number of combinations to try. A 16-character random password mixing upper and lower case, digits and symbols offers more than 10 to the power of 31 possibilities, beyond the reach of any brute-force attack.

Generating a password

Set the length with the slider and tick the character types to include: uppercase, lowercase, digits, symbols. An option excludes ambiguous characters, such as 0 and O or l and 1, handy for a password you have to copy by hand. Click "Generate": a meter rates the strength of the result, and "Copy" puts it on the clipboard.

Which length?

If a site rejects some symbols, make up for it with extra length.

The three rules that matter

1. A different password for every site. When a site's database is stolen, attackers try the same credentials everywhere else. This is the most common cause of hacked accounts.
2. A password manager. Nobody can remember dozens of random passwords. A manager, built into your browser or phone or standalone, remembers and fills them in for you.
3. Two-factor authentication on important accounts, using an app or a security key rather than SMS where possible.

What about a passphrase?

For the password you must remember by heart, such as the one for your manager or your computer, a passphrase of four to six randomly chosen, unrelated words is both strong and memorable. Avoid quotations, song lyrics and proverbs, which appear in attackers' dictionaries.

How is the password generated?

Toolo uses your browser's cryptographic generator (crypto.getRandomValues), designed to produce unpredictable randomness, unlike ordinary random functions. The password is created on your device and is never transmitted or stored.

Frequently asked questions

Is the password sent anywhere?

Never. It is generated locally with your browser's cryptographic generator, and is neither transmitted nor stored.

Should I change my passwords regularly?

Current guidance, including from NIST, recommends a long, unique password, changed only if you suspect a leak.

How do I know if my password has leaked?

Password managers built into browsers flag passwords that have appeared in known breaches. Change any affected ones immediately.

Are symbols essential?

They strengthen a password, but length counts for more. If a site rejects them, add a few characters.