Password Generator
Strong random passwords and passphrases.
- Free
- No sign-up
- Private: runs in your browser
Bulk generate
Generated on your device with the Web Crypto API. Nothing is sent, stored or logged.
Create strong passwords you can trust
Most account break-ins do not come from clever hacking but from weak or reused passwords. When one website leaks its database, attackers try the same email and password everywhere else. A long, random and unique password for every account stops that. This generator creates them on your own device with the browser's cryptographic random number generator, so no one else ever sees them.
Password or passphrase?
- Random password: best when a password manager fills it in for you. Use 16 characters or more with all character types.
- Passphrase: best for the few passwords you must remember or type, such as your computer login or the master password of your password manager. Five or six random words from the 1,296-word list give 52 to 62 bits of entropy, and more with a number and capitals.
How the strength meter works
The meter shows entropy in bits, calculated from the size of the character set or word list and the length. It is an honest measure because the password is truly random: an attacker who knows exactly how it was made still needs, on average, half of all possible combinations. The estimated crack time assumes a fast offline attack of ten billion guesses per second, which is a worst case; online attacks are millions of times slower.
Good password habits
Use a different password for every account and keep them in a reputable password manager. Turn on two-factor authentication wherever you can, preferably with an authenticator app or security key rather than SMS. Change a password straight away if a service reports a breach. Never share passwords over chat or email; if you must send one, use our message encryption tool and share the key separately.
Bulk generation
Need passwords for new staff accounts, Wi-Fi guests or test users? Open "Bulk generate", choose up to 100 and copy or download them as a text file. Each one is generated independently with the same settings.
Frequently asked questions
Are these passwords really random?
Yes. They come from your browser's cryptographically secure random number generator (crypto.getRandomValues), the same source used for encryption keys. The tool also avoids the small bias that simple modulo arithmetic would add, so every character and word is equally likely.
Is the password sent or saved anywhere?
No. Passwords are generated on your device and are never sent to a server, logged or stored. Closing or reloading the page clears them.
How long should a password be?
For accounts protected by a password manager, 16 to 20 random characters is plenty. For a password you must type or remember, a passphrase of five or six random words is both strong and easy to type.
What is entropy in bits?
Entropy measures how many guesses an attacker needs: each extra bit doubles the work. 60 bits resists online attacks, 80 bits resists strong offline cracking, and 100 bits or more is far beyond any realistic attack.
Why exclude similar characters?
Characters such as l, 1, I, O and 0 are easy to confuse when you read a password aloud or type it from a screen. Excluding them makes the password a little shorter in entropy per character but easier to use.