Complex password generator

Many corporate and government systems still require at least one of each character type. This mode guarantees that requirement is met on every password it produces, in addition to strong overall randomness.

Generated entirely in your browser Cryptographically secure randomness Nothing is ever transmitted or stored
18
Advanced options
5
12
6

Generate in bulk

Create several passwords at once using the settings above — useful for provisioning multiple accounts.

Check a password's strength

Type any password to score it instantly. This runs entirely in your browser — nothing is sent anywhere, logged, or stored.

Type a password above

Tips

Check the specific composition rule if one is given

Some systems require a minimum count of each type, not just one — this generator guarantees at least one of each selected type by default.

Don't mistake complexity rules for the whole picture

Meeting a composition requirement doesn't guarantee strength on its own — length still matters more than satisfying a checklist.

Increase length rather than relying only on required character types

If a system's complexity rules feel restrictive, compensate with extra length rather than settling for the shortest password that technically qualifies.

Frequently asked questions

What does 'complex' mean for a password?

Typically a requirement to include a mix of uppercase, lowercase, numbers, and symbols — this generator guarantees at least one of each by default.

Are complexity requirements actually effective?

They're a baseline, but modern security guidance (including NIST) increasingly emphasizes length over strict composition rules.

Will this always include every character type?

Yes — with 'require each type' enabled, every generated password includes at least one character from each type you've selected.

Is a long simple password ever better than a short complex one?

Often, yes — a longer password built from a wider pool of possible characters is generally harder to crack than a shorter one stuffed with mandatory complexity, so length should rarely be sacrificed for complexity alone.

Why do some sites reject passwords that look complex enough?

Some systems have hidden rules, like banning consecutive repeated characters or certain symbols, that aren't obvious from the stated requirements — if a generated password is rejected, try regenerating or adjusting the character toggles.

Does a complex password protect against phishing?

No — complexity only helps against guessing and brute-force attacks. No password, however complex, protects you if you're tricked into entering it on a fake site.