Strong random passwords and memorable passphrases, generated on your device
Runs in your browser. Nothing you type is sent anywhere. Updated on 24 Oct 2026.A generated password is random in a way a person cannot be, which is what makes it hard to guess. Choose a length of 16 or more characters, or a passphrase of several words if you have to type it by hand. Generated on your device and never transmitted.
Keep Password selected under Mode, and set the Length slider between 8 and 128 characters.
Turn Lowercase, Uppercase, Digits and Symbols on or off, and Exclude ambiguous if it will be typed by hand.
Read the bits figure and "How long it would take to crack" under the password.
Click Copy, or Regenerate for a new one; Generate 10 gives ten more with the same options.
This password generator creates a strong random password of 8 to 128 characters, or a passphrase of three to ten random words, and shows you how strong it is in bits and in the time it would take to crack. Pick the character types you need, drop look-alike characters such as 0, O, 1 and l, copy the result, and generate ten at once when you need a batch.
People use it when a new account demands a 16 character password with symbols, when a Wi-Fi or admin password has to be typed on another device and must not contain ambiguous characters, or when they want a diceware style passphrase they can actually remember for a password manager or disk encryption.
Every value is produced on your device with the browser's crypto.getRandomValues, the same source used for encryption keys. Draws are rejection-sampled so no character is more likely than another. Nothing is sent to a server, nothing is logged, and generated passwords are not saved anywhere, not even in this browser. Only your option settings are remembered.
Use a passphrase for anything you type by hand or need to recall: a master password, a laptop login, an encryption key. Use a long random password for everything else and store it in a password manager, so each site gets its own and you never reuse one. Related tools: Password Strength Checker, Bcrypt Hash and Verify, TOTP Generator.
Yes. There is no signup, no limit on how many passwords you generate and no premium tier for longer passwords. The site is funded by a small number of ads shown below the tool, never inside it.
No password ever leaves your device. Values are generated in your browser with crypto.getRandomValues, are not sent to a server, are not logged, and are not saved in browser storage either. Only your option settings, such as length and character types, are remembered on this device. Close the tab and the generated values are gone.
At least 12 characters for everyday accounts and 16 or more for email, banking and anything that resets other passwords. With all four character types, 16 characters gives about 102 bits of entropy, which is far beyond what an offline attack can search. Length matters more than symbols: a 20 character password of letters alone beats a 10 character one with symbols.
A passphrase is a password made of several random words, for example lantern-cobalt-sparrow-orbit-quilt. Five words from this list give about 57 bits of entropy and are much easier to type and remember than a string of symbols. The words must be chosen at random by the tool; a sentence you make up yourself is far weaker because people pick predictable words.
Entropy is the number of equally likely values the generator could have produced, expressed in bits. Each extra bit doubles the number of guesses an attacker needs. 40 bits falls in minutes to an offline attack, 60 bits takes years, and 80 bits or more is out of reach. The crack time shown assumes 10 billion guesses per second, which is a well-funded attacker against a fast hash.
The characters 0, O, 1, l, I and | look alike in many fonts, so a password that contains them is easy to mistype when read from a screen or paper, for example a Wi-Fi key or a temporary password sent to a colleague. Excluding them removes five characters from the pool (the pipe is not in the symbol set anyway) and costs less than a tenth of a bit of entropy per character.
Still stuck? Ask about Password Generator and anybody who knows can answer. No account needed.
Same job, other tools: Bcrypt Generator – Generate a bcrypt hash for a test user or a config file · HMAC-SHA256 Generator – Compute an HMAC-SHA256 signature in hex and Base64 · OTP Generator – Time-based one-time passwords with 6 or 8 digits and a choice of algorithm.
On the related tools: SRI Hash Checker – Check whether a file still matches its integrity attribute before the browser blocks it.
In the collections Security Tools for Developers · Test Data Generators.