Password Generator

Generate secure, random passwords.

100% client-side. Your data never leaves your browser.

Click Generate to create a password
Password Strength -
16
8 128

In Laravel

Laravel generates random passwords with Str::password(). The default length is 32 characters, with letters, numbers and symbols:

use Illuminate\Support\Str;

$password = Str::password();    // 32 characters
$password = Str::password(16);

For passwords that users choose, define the rules once with Password::defaults() in a service provider, and use them in every form. uncompromised() rejects passwords that appear in known data breaches. It sends only the first five characters of the password's SHA-1 hash to the Have I Been Pwned API, never the password.

use Illuminate\Validation\Rules\Password;

// AppServiceProvider::boot()
Password::defaults(fn () => Password::min(15)->uncompromised());

// In a form request or controller
$request->validate([
    'password' => ['required', 'confirmed', Password::defaults()],
]);

Laravel 13.x docs: Str::password(), Validating passwords

Cryptographically Secure

Uses the Web Crypto API for true randomness. Same technology used by password managers.

100%

Client-Side

All processing happens in your browser. Your passwords never touch our servers.

Free

No Limits

Generate unlimited passwords. No signup.

Related Tools

UUID/ULID Generator Hash Generator

Need something custom built?

I build custom Laravel tools, web apps, and SaaS platforms. If you need something beyond off-the-shelf, let's talk.

Contact

Frequently Asked Questions

How long should a generated password be?

With all four character sets on, this generator picks from 88 characters, so each character adds about 6.5 bits of randomness. 12 characters give about 77 bits, and 16 characters about 103 bits. For a password you keep in a password manager, 16 or more is a good default, because you never type it.

Should my app force users to include symbols?

No. NIST's current guidelines (SP 800-63B-4) say services must not require a mix of character types. They ask for length instead: at least 15 characters when the password is the only factor, and at least 8 with multi-factor authentication. Services must also reject passwords from breach lists. In Laravel that is Password::min(15)->uncompromised(), without mixedCase() or symbols().