Strong passwords, made on your device
Generated in your browser with its secure random number generator. Nothing is sent, saved, or logged.
How it works
Real randomness
Each character is picked with crypto.getRandomValues, the same secure random source browsers use for encryption keys. Picks are unbiased, so no character is more likely than another.
Honest strength
The meter counts exactly how many passwords your settings could produce. The time estimate assumes an attacker making 100 billion guesses per second, which is a well-funded offline attack.
Length beats tricks
Adding characters raises strength far faster than adding symbol types. Current NIST guidance asks for at least 15 characters when a password is the only thing protecting an account. Read the tips.