Password generator
Create a strong, random password in one click, for any site or app.
Made in your browser with a secure random source. Nothing you generate here is sent to us or stored.
What makes a password hard to crack
Length beats everything
Each extra character multiplies the guesses an attacker needs. Aim for 16 characters or more, 20 is better.
Truly random, not clever
Swapping an "a" for "@" in a word is the first trick cracking tools try. Random characters have no pattern to guess.
One password per account
When one site leaks, attackers try the same email and password everywhere else. A unique password stops that at the first site.
Nothing personal
Names, birthdays, pets and teams are easy to find online. A generated password has none of that in it.
Don't memorize it. Let Vault remember.
Strong passwords are only useful if you don't have to type them. Vault saves each new password as you sign up and fills it in next time, on every computer.
Questions
Is this password generator safe to use?
Yes. The password is created in your browser with the Web Crypto random number generator, the same source used for encryption keys. It never leaves your device, and we don't log or store it.
How long should my password be?
At least 16 characters for important accounts. If a site allows it, 20 or more with all character types is very hard to crack. When a site has a maximum length, use the longest it allows.
What do "Easy to read" and "Easy to say" do?
"Easy to read" leaves out characters that look alike, such as l, 1, I, O and 0, which helps if you have to copy a password by hand. "Easy to say" uses letters only. Both are weaker than "All characters" at the same length, so make them a bit longer.
Can a strong password still be hacked?
It can still be stolen, for example by a phishing page or a breach at the site that stores it. That's why each account should have its own password, and why turning on two-step login matters too.
Can you make usernames too?
Yes, try the username generator.