Password Generator
Generate strong, random passwords instantly — free, no account required.
What Makes a Strong Password?
A strong password is long, random, and unique — used for one account and one account only. The Canadian Centre for Cyber Security (CCCS) recommends a minimum of 15 characters and strongly endorses password managers as the practical solution to managing unique credentials across dozens of services.
Canada's privacy landscape is governed by PIPEDA (Personal Information Protection and Electronic Documents Act) at the federal level, and by provincial laws — most notably Quebec's Law 25 (Law modernising provisions relating to the protection of personal information), which came into force in stages between 2022 and 2023 and introduced some of the strictest requirements in North America. Under these frameworks, organisations must implement security measures commensurate with the sensitivity of the data they hold — and credential compromise consistently tops breach reporting statistics.
This generator uses crypto.getRandomValues() — the browser's cryptographically secure random API — to create your password. Everything happens in your browser; nothing is transmitted to our servers.
How the Password Generator Works
Configure your character set using the toggles — uppercase, lowercase, numbers, symbols — and adjust the length slider between 8 and 128 characters. The generator assembles your chosen pool and draws each character position independently using crypto.getRandomValues() with rejection sampling to eliminate statistical bias. The strength meter updates in real time as you adjust settings, showing you both the bit count and the estimated time to crack.
Fully client-side. No password data is ever sent to our servers. There are no analytics payloads, no POST requests on generate, no server-side logging. The page works offline once loaded. Open your browser's Network inspector and verify for yourself — zero outbound requests when you generate.
Understanding Entropy and Password Strength
Entropy measures unpredictability in bits. The formula: entropy = log₂(pool size) × length. At 16 characters using all printable ASCII (95 characters), you get approximately 105 bits. The CCCS's guidance aligns with NIST in recommending entropy as the meaningful metric, not arbitrary composition rules.
Concretely: a 72-bit password takes approximately 2.4 billion years to brute-force at 1 billion guesses per second. A 105-bit password exceeds the computational resources of any organisation — state-level or commercial — for any foreseeable future. The "time to crack" figure on our meter uses this 1 billion/second baseline so you can see what your settings actually mean in practice.
Password Best Practices for Canadian Users
- Unique passwords for banking, CRA My Account, and email first. These three access points represent your financial and identity infrastructure. A compromised CRA account can be used to redirect tax refunds; a compromised email unlocks password-reset flows for everything else.
- Enable multi-factor authentication. The CCCS lists MFA as the highest-priority individual action. Most Canadian banks, the CRA My Account portal, and major services support it.
- Use a password manager. The CCCS explicitly recommends password managers. Bitwarden (open-source, free tier available), 1Password (Canadian-founded), and Dashlane are all widely used.
- Bilingual note for Quebec residents: Quebec's Law 25 gives consumers new rights over their personal data, including breach notification. If a service notifies you of a breach, treat your password for that service — and any service where you reused it — as compromised immediately.
- Watch for CRA phishing. The CRA is one of the most impersonated institutions in Canada. The CRA will never send you a text message with a link asking for login credentials. Any such message is a phishing attempt.
Password Security in Canada: Regulatory Context
PIPEDA requires organisations to report breaches that pose a "real risk of significant harm" to the Office of the Privacy Commissioner of Canada (OPC) and to notify affected individuals. The OPC publishes annual breach reports — credential compromise is consistently the leading cause.
Quebec's Law 25 goes further, introducing mandatory privacy impact assessments, a designated privacy officer requirement, and stricter consent rules — among the most demanding in North America. Penalties reach CAD $25 million or 4% of worldwide turnover for the most serious violations.
Canada's bilingual character creates a unique SEO and content opportunity: significant search volume exists in both English and French for password-related queries. French-language Canadian users searching "générateur de mot de passe" will find localised content here, not an English-only page with a language flag bolted on.
FAQ
- What does the Canadian Centre for Cyber Security recommend for passwords?
- The CCCS recommends using a password manager to create and store long, unique passwords for every account, enabling multi-factor authentication wherever possible, and avoiding the reuse of passwords across services. They recommend a minimum of 15 characters for new passwords.
- Is this generator safe to use?
- Yes. Passwords are generated entirely in your browser using
crypto.getRandomValues()— a cryptographically secure API. Nothing is sent to our servers. No account is required. You can verify this in your browser's Network developer tool: no outbound requests fire when you click Generate. - Does this tool comply with PIPEDA and Quebec Law 25?
- Our generator collects no personal data whatsoever. There is no account creation, no email collection, no cookies beyond what is necessary to serve the page, and no password data transmitted anywhere. A tool that processes nothing cannot mishandle anything — compliance is architectural, not just policy.
- What should I do if the CRA notifies me of a breach?
- Change your CRA My Account password immediately using a strong, unique password generated here. Enable multi-factor authentication on your CRA account if not already done. Check whether you reused the same password on any other service and change it there too. File an identity theft report with the Canadian Anti-Fraud Centre (antifraudcentre.ca) if you suspect your SIN has been misused.
- What is the difference between PIPEDA and Quebec Law 25?
- PIPEDA is the federal privacy law applying to commercial organisations across Canada. Quebec Law 25 is a provincial law that applies to organisations operating in Quebec and is generally stricter — it includes requirements for privacy impact assessments, a designated privacy officer, and broader consent requirements. Both mandate reasonable security measures to protect personal data.
- Can I generate passwords in bulk?
- Yes — up to 50 at once. Adjust the "Number of passwords" counter, click Generate, and use "Copy All" to copy the full list to your clipboard. This is useful for IT teams provisioning accounts, developers creating test data, or anyone replacing many weak passwords in a single session.