This free password generator creates random passwords locally in the
browser with the Web Crypto API. The generated password is not sent to a
server or stored by the tool. Choose the length and character groups,
generate a unique password and save it directly in a trusted password
manager.
Generated locally in your browser with crypto.getRandomValues. Nothing is transmitted or logged.
What makes a password strong?
Length and unpredictability matter more than clever substitutions. A
long random password drawn from a large character set is resistant to
guessing because each position adds possible combinations. Replacing “a”
with “@” in a familiar phrase does little when attackers already test
common patterns.
Use at least 16 random characters for ordinary accounts when the
service permits it. Higher-value credentials can use 20 or more. Follow
the site’s maximum length and accepted characters without reducing every
password to one reused format.
Why must every password be
unique?
When one service is breached, attackers test exposed
email-and-password pairs on other sites. A unique password confines the
damage. Reusing one strong password is therefore weaker than storing a
different random password for every account.
Never create a predictable series such as adding the site name or
changing the final digit. Those variations are easy to infer after one
password is known.
How does the generator work?
The included tool uses crypto.getRandomValues, a browser
facility designed for cryptographically strong random values. It selects
characters without sending a request to MengOnline. The page must still
be served over HTTPS and should not load analytics that capture form
values.
The code guarantees that selected character groups appear at least
once, then securely shuffles the result. Inspect the open source
included with the page before deployment and do not add logging around
the output field.
Should symbols always be
included?
Include lowercase, uppercase, numbers and symbols when the site
accepts them. Some older systems reject particular symbols or truncate
long input. Never silently reuse a weaker password because of that
restriction; generate another unique value within the supported
policy.
Length can compensate for a smaller allowed character set. A long
random passphrase is also suitable where typing matters, provided its
words are selected randomly rather than composed as a known
quotation.
Where should passwords be
stored?
Use a reputable password manager protected by a strong master
password and multi-factor authentication. The manager can generate, save
and autofill unique credentials and warn about reused or exposed
passwords.
Do not keep a plain spreadsheet, unencrypted note or email draft of
active passwords. Avoid copying a password through shared clipboards or
messaging apps. Clear the clipboard after use when the operating system
does not do so automatically.
Is a generated password
enough?
No. Turn on phishing-resistant multi-factor authentication or a
passkey where available. Keep recovery methods current and store
recovery codes securely. A strong password cannot protect an account
when it is entered into a convincing phishing page or the recovery email
is compromised.
Check the domain before signing in. A password manager that refuses
to autofill on the wrong domain provides an additional warning.
Password versus passkey
Passkeys use public-key cryptography and are designed to resist
phishing because the credential is tied to the legitimate service. When
a trusted service supports passkeys, they can remove the need to invent
and type a password.
Keep device locks and account recovery secure. A passkey is not a
reason to ignore the security of the device or cloud account that
synchronizes it.
Safe use of this generator
Open the page over HTTPS, generate the password on a trusted device,
save it in the manager and close the page. Do not paste an existing
password into any strength checker. Generate a new credential
instead.
The tool should never claim that a particular password is impossible
to crack. Security depends on randomness, length, rate limits, storage
by the service and the protection of the user’s devices.
