Password generator
Make a strong, random password in one click. Choose the length and character types, or switch to an easy-to-type passphrase, and see how long it would take to crack.
Estimated time to crack:
Made in your browser with its cryptographic random generator. Nothing is sent or saved.
How to use it
- Choose "Characters" for a classic password or "Passphrase" for random words.
- Set the length with the slider and tick the character types you want. A new password appears with every change.
- Check the strength meter: it shows the entropy in bits and an estimated time to crack.
- Click the copy button next to a password, then paste it into your password manager or sign-up form.
What it does
Length from 4 to 128
Drag the slider or type a number. Sixteen characters with all four types gives about 103 bits of entropy.
Every option you need
Uppercase, lowercase, numbers and symbols, your own symbol set, no look-alike characters (0 O 1 l I) and no repeated characters. Each type you tick is guaranteed to appear.
Passphrase mode
Join 3 to 12 random words from a built-in list of 1,605 English words. Pick the separator, capitalize the words or add a number.
Strength and crack time
See the entropy in bits and the estimated time to crack at three attacker speeds, from an online login to a large cracking cluster.
Up to 50 at once
Generate a batch, copy any single password or copy them all, and replace one row without touching the others.
Private by design
Passwords are created in your browser with the cryptographic random generator (crypto.getRandomValues). They are never sent anywhere or saved; only your settings are remembered on this device.
Good to know
What makes a password hard to guess is its entropy, the number of equally likely combinations an attacker would have to search. Every added character multiplies that number, so length matters more than any special rule. A 16-character password drawn from 94 symbols has about 105 bits of entropy, far beyond what any realistic attack can reach, while an 8-character one has about 52 bits.
A passphrase trades length for memorability. Six random words from a list of 1,605 give about 64 bits, and five give about 53. Passphrases suit the few passwords you must type from memory, such as a password manager's master password or a device login. For everything else, let a password manager store a long random password. The crack time shown here is an estimate for guessing at random; it assumes the password is not reused and not leaked elsewhere.
Questions and answers
Are the passwords really random?
Yes. Characters and words are picked with crypto.getRandomValues, the cryptographically secure generator built into your browser, using a method that avoids bias. Math.random is never used.
Is the password sent or stored anywhere?
No. Everything happens on your device. The page keeps only your option choices in this browser's local storage, never the passwords themselves.
How long should a password be?
For accounts you protect with a password manager, 16 characters or more is a good choice. For important accounts such as email and banking, use 20 or more. Longer is always safer.
What does entropy in bits mean?
Each bit doubles the number of combinations an attacker must try. 60 bits is already hard to crack offline with ordinary hardware, and 80 bits or more is considered very strong.
Why exclude look-alike characters?
Characters such as 0 and O, or 1, l and I, are easy to confuse when you read or type a password by hand. Excluding them makes it easier to copy, at a small cost in entropy.
Is a passphrase as safe as a random password?
Per character it is weaker, but a passphrase of six or more random words reaches around 64 bits or more and is far easier to remember and type. Add more words to raise the strength.