Free Security Questions & Answers Generator
Pick security questions for account recovery and get random answers that nobody can look up. Choose a category, an answer style and a length, see the exact strength of every answer, then copy them into your password manager or save an encrypted backup.
100% client-side · Web Crypto randomness · Nothing is stored or sent
These files are not encrypted. Store the answers in a password manager, or use the Encrypted backup tab, and delete any plain file afterwards.
Figures are for the random answers made with the current settings. Time assumes 1,000 guesses per second with no lockout, which is more than a real recovery form allows. Answers you type yourself are shown with an upper limit only.
Save the questions and answers on the Generate tab as one encrypted file, or open a file you saved before. Encryption is AES-256-GCM with a key made from your passphrase (PBKDF2-SHA-256, 600,000 rounds). The passphrase cannot be recovered.
How the Security Questions Generator Works
Questions are picked at random from a built-in bank of about 250 questions, without repeats, using your browser’s cryptographic random number generator. Questions that ask for card numbers, account numbers or passwords have been left out, because those answers should never be written down in a recovery form.
Each random answer is built from the same secure generator. Pronounceable answers join consonant-and-vowel syllables, such as bakuze-moridi, and the other styles pick letters and digits. The strength is exact: the number of random choices multiplied by the bits in each choice, and the total for all answers on a form is the sum. If you type an answer yourself, the page can only give an upper limit, because answers about your own life are easier to guess than their length suggests.
Web Crypto Randomness
Questions and answers are chosen with crypto.getRandomValues and unbiased selection
Exact Answer Entropy
Bits per answer, all answers combined and the average time to guess one
Three Answer Styles
Pronounceable words, lowercase letters, or mixed letters and digits
Swap Any Question or Answer
Replace one question or one answer without redoing the rest
Encrypted Backup
AES-256-GCM with a PBKDF2 key, and you can reopen the file on this page
Safer Exports
Text, JSON and CSV, with spreadsheet-formula protection and no browser storage
Explore more free tools in our security tools collection, including our strong random password generator.
Frequently Asked Questions
1. Should I use security questions at all?
Only when a service gives you no choice. The answers to questions such as a first pet or a birthplace can often be researched, guessed or found on social media, so security questions are a weak way to recover an account. Current NIST guidance (SP 800-63B) advises services not to use them. Prefer an authenticator app, a passkey or recovery codes where they are offered.
2. Why use random answers instead of true ones?
A true answer is only as safe as the facts about you are private. A random answer, stored in a password manager, cannot be looked up or guessed from your life, so it acts like a second password. The service only checks that the answer you give matches the one you stored, so it does not need to be true.
3. How are the random answers made and how strong are they?
Questions and answers are chosen with your browser’s cryptographic random number generator, with unbiased selection. Pronounceable answers are built from consonant-and-vowel syllables (90 possibilities each, about 6.5 bits per syllable), and the other styles pick letters and digits at random. The strength shown is exact: the number of bits is the count of random choices multiplied by the bits in each choice.
4. Where should I store the answers?
In a password manager, in the same entry as the account they belong to. If you need a file, use the encrypted backup on the Backup tab. The text, JSON and CSV exports are not encrypted, so delete them once the answers are stored safely, and never keep them in plain notes or email.
5. How many questions should I generate?
As many as the service asks for, usually three to five. Each answer should be random and different, so every extra answer multiplies the work for an attacker. The page shows the combined strength of all your answers.
6. Can I use the same answers on several sites?
No. Treat each answer like a password and use new ones for every account, so a leak at one service does not open the others.
7. What if a site rejects my answer?
Some sites limit length or characters. Choose lowercase letters only for sites that ignore case or reject symbols, switch hyphens off, or use a shorter length. Keep it at 40 bits or more where you can.
8. Can I type my own answers?
Yes: switch off the random fill, or edit any answer. The page then shows only an upper limit on its strength, because answers about your life are usually much easier to guess than their length suggests. Avoid anything that appears on social media or in public records.
9. How does the encrypted backup work?
Your questions and answers are encrypted with AES-256-GCM, using a key made from your passphrase with PBKDF2-SHA-256 (600,000 rounds) and a random salt. You can reopen the file on the Backup tab with the same passphrase. The passphrase cannot be recovered, so store it in your password manager too.
10. Is my data stored or sent anywhere?
No. Everything runs in your browser, the page’s content security policy blocks outgoing network requests, no outside scripts are loaded, and nothing is saved in cookies or local storage. The page clears the answers after 10 minutes without activity. The earlier version’s optional browser storage has been removed.