🔑Free tool · works offline

Strong password generator

The password is created right in your browser and never sent anywhere. We can’t see it or store it.

Strength

20

Generation happens locally. The password never leaves your device.

How to protect your accounts

01

A unique password for every site

One leak should never unlock all your accounts at once.

02

At least 16 characters

Length beats complexity: a long password is orders of magnitude harder to crack.

03

Turn on two-factor

Even if a password leaks, a second factor (a code from an app) blocks the login.

Protect yourself fully — not just with a password

The Plus plan adds data-breach monitoring to Aurora’s VPN and ad blocker.

See plans

Frequently asked questions

How is the password generated?
In your browser, from the operating system's cryptographic random source. Nothing is sent anywhere and nothing is stored — close the tab and the password exists only where you saved it.
How long should a password be?
Sixteen characters is a sensible floor today, and length beats exotic symbols: each extra character multiplies the work of guessing far more than swapping a letter for a symbol does.
Should every site have its own password?
Yes, and it is the single most useful habit. One breach then costs one account instead of every account that shared the password — see the data-leak checker for what reuse actually costs.

Updated: 2026-08-17

Other tools