Password Generator
Create a strong password two ways: a random string of characters, or a memorable passphrase made of real words. Everything is generated in your browser using its secure random number generator, and nothing you make is ever sent anywhere.
Adjust the options to generate a result.
Generated in your browser with the device’s secure random generator (Web Crypto). Nothing you generate is sent to a server, saved, or put in the page address — copy it somewhere safe.
Two ways to make a password
- Random characters — a string drawn from the character types you turn on (lower case, upper case, digits, symbols). The generator guarantees at least one character from each type you enable, and you can exclude look-alike characters (
I l 1 O 0) if you'll be typing the password by hand. - Memorable passphrase — several real words picked at random and joined with a separator, like
squid-cinema-cluster-hazel-paddle. This is the diceware idea: much easier to remember and type, and strong as long as you use enough words.
What "strength" means
The strength meter shows entropy in bits. Each bit doubles the number of possible passwords, so bits are a compact way to say "how hard is this to guess." More characters — or more words — means more bits.
For a random character password using all four types (a pool of 90 characters):
- 8 characters — about 52 bits (Fair)
- 12 characters — about 78 bits (Strong)
- 16 characters — about 104 bits (Very strong)
For a passphrase from this generator's word list:
- 4 words — about 38 bits (Weak)
- 5 words — about 47 bits (Fair)
- 7 words — about 66 bits (Strong)
As a rough guide: under 40 bits is weak, 40–59 is fair, 60–79 is strong, and 80 or more is very strong.
Why a passphrase beats "P@ssw0rd1"
Swapping letters for symbols feels clever, but attackers know every trick. P@ssw0rd1 is short and based on a common word, so it falls fast. A five- or six-word random passphrase is longer, has no dictionary pattern to exploit, and you can actually remember it. Length and true randomness win; cute substitutions don't.
A note on how it's made
Every password here is generated on your device using the browser's cryptographically secure random generator (crypto.getRandomValues). It's never created on a server, never sent over the network, and never written into the web address — so there's no copy of it anywhere but your screen. When you've copied it somewhere safe, generate a fresh one or close the tab.
Frequently asked questions
What makes a password strong?
Length and randomness, not clever substitutions. A password's strength is usually measured in bits of entropy — roughly, how many guesses an attacker would need. A random 16-character password using upper and lower case, digits, and symbols is about 104 bits, which resists even offline cracking. A short password like P@ss1 is weak no matter how many symbols it has, because there just aren't many of them.
Is a passphrase as safe as a random password?
Yes, if you use enough words. This generator's default of 7 random words is about 66 bits of entropy — strong, and far easier to type and remember than a random string. Fewer words is weaker: 4 words is only about 38 bits. The safety comes from the words being chosen at random, so don't pick your own.
Is this password generator safe to use?
Yes. It runs entirely in your browser using the Web Crypto API — the same secure randomness browsers use for encryption — so every password is unpredictable. Nothing you generate is sent to a server, saved, or put in the page address. Close the tab and it's gone.