Password Generator
Create strong random passwords and passphrases, with the entropy behind each one.
Runs fully in your browser. Nothing you paste here is sent anywhere.
Options
Result
About this tool
A strong password is ready the moment the page opens, and a new one appears with every change you make. Choose the length, which character types to use and exactly which symbols count, leave out look-alikes such as l, 1 and O, 0, and list any characters a site refuses. Digits and symbols are tinted in the result, so a password read aloud or typed from another screen comes out right.
Switch to passphrase for something you can remember and type on a phone: random words from the EFF Diceware list of 7,776, joined by the separator you choose, optionally capitalised and with a digit added. Need a batch for seeding test accounts? Set how many — up to 50 — and copy them all at once, one per line.
The strength bar is computed, not guessed from patterns. It counts exactly how many passwords your settings allow — including the rule that every chosen character type appears — and turns that into bits of entropy and an average time to crack at a trillion guesses per second. The options cannot be set into a dead end: the last character type stays on, and out-of-range numbers are clamped.
Every character comes from your browser’s cryptographic random generator, drawn without the modulo bias that skews naive generators. The page is static HTML and generation runs in your tab: no password is sent, logged or stored. Your options are saved in this browser for next time; the passwords never are.
Frequently asked questions
Are the generated passwords sent or stored anywhere?
No. They are created by JavaScript in your tab and exist only on your screen and in your clipboard when you copy one. The page has no backend to send them to, and it keeps working offline. Only your options — length, character types and so on — are saved in your browser’s local storage.
How random are they?
Each character or word is drawn from crypto.getRandomValues, the same cryptographically secure generator browsers use for TLS keys. Values that would favour some characters over others are discarded and redrawn, so every character in the pool is exactly equally likely.
How long should a password be?
For an account protected by a password manager, 16 to 20 random characters is plenty: that is over 100 bits with all four character types. Aim for at least 70 bits, where the bar turns green. For a passphrase you type by hand, six words from the Diceware list gives about 78 bits.
Why are some symbols missing by default?
The default set, !@#$%^&*-_=+?, is accepted by nearly every sign-up form and is safe unquoted in shells, JSON and .env files. Quotes, backslashes and angle brackets often break one of those. Edit the symbols field to use any set you like, or list characters to avoid under “Never use”.
What does the crack time assume?
An offline brute-force attack at a trillion guesses per second — a GPU cluster against a fast, unsalted hash such as MD5 — finding the password after searching half the possibilities on average. A site that stores passwords with bcrypt or Argon2 slows that down by many orders of magnitude, so the estimate is deliberately the pessimistic one.
Is it really free?
Yes, with no account and no usage limit. The site is funded by ads placed around the tool, never inside your working area.