Password Generator: Free Online Tool: Ferra

How do you generate a strong password?

The strongest password you'll ever make is boring: long and random. This generator builds one by drawing every character at random from the sets you enable, uppercase letters, lowercase letters, numbers, symbols, up to the length you choose, using the browser's own random number generator. All of it happens locally. The password isn't sent or logged anywhere, and it isn't stored: nothing leaves the browser.

Length does more than any other setting. Every added character multiplies the number of possible passwords, so a 20-character password of nothing but letters is far harder to guess than an 8-character one drawing on every set. A sensible default for anything that matters: 16 characters or more, several sets enabled. The exception is a site with restrictive rules: some reject certain symbols or cap length, and there the fix is turning off Symbols or shortening the setting, never hand-editing the result.

If your team runs shared accounts, the inventory, who owns what, when each password last rotated, fits naturally as rows in a Ferra table. The passwords themselves live in a password manager, never in a spreadsheet.

How the Password Generator works

Set a length, tick the sets you want, generate. Each character is drawn at random from the pool you've enabled, every click produces a fresh password, and because the work runs locally in your browser, nobody, including us, ever sees the result.

Length: How many characters the password gets. Longer is stronger, 16 or more for any account you care about.
Uppercase letters: Adds capitals to the pool: A through Z minus the easily-confused I and O. Widens the character space and satisfies sites that require mixed case.
Lowercase letters: Adds a through z minus the ambiguous l. Leave it on in almost every case.
Numbers: Adds the digits 2 through 9; 0 and 1 sit out because they're too easy to mistake for O and l, and plenty of sites require a digit anyway.
Symbols: Mixes in punctuation like # and %. Turn it off for sites that reject special characters instead of editing the password afterward.

What you're looking at

Set Length to 16 with all four boxes checked: the result is a jumble of capitals, lowercase, digits, and symbols in no discernible order, and a completely different jumble on the next click. That's the point. There's no pattern to memorize, because this password isn't headed for your memory: it's headed for a password manager.

Appearance fools people. An 8-character password bristling with symbols looks fierce and is far weaker than a plain 20-character one, the math of length beats the variety of characters. Make a password longer before you make it fancier, and never reuse a generated password across accounts.

When to use the Password Generator

Every new credential is an occasion to use it: a signup, a service account, a shared login for a team system, a rotation after someone leaves. Humans invent randomness badly: self-made passwords cluster around names, dates, and keyboard patterns, which is exactly what attackers try first. A generated password sidesteps the whole failure mode.

A breach notice is the other trigger. When a service you use reports an incident, generate a fresh password for that account, and for every account where you'd reused the old one. Sensitive accounts are fine here too: because everything runs entirely in your browser, the password exists nowhere but your screen until you save it somewhere you choose.

Tips for the Password Generator

A generated password is only as good as the thirty seconds after you copy it. These habits close the usual gaps.

Make length the priority: Get to 16 characters or more before you think about symbols. Length multiplies difficulty; extra character sets merely add to it.
One password per account: Generate fresh for every signup. Reuse means one breached site unlocks the others.
Store it in a password manager: Random means unmemorizable by design. Save it to a manager the moment you copy it, not pasted into a chat, not parked in a note or a spreadsheet.
Regenerate, don't edit: A site rejected it? Change the settings and click again. Hand-editing a random password reintroduces human patterns.
Rotate after any incident: A breach notice or a departed teammate with shared access means a replacement, generated right away: likewise a password pasted anywhere it shouldn't have been.