Everything runs in your browser with crypto.getRandomValues. Nothing you generate is sent, logged or stored anywhere.
What Is a Password Generator?
A password generator creates random passwords or passphrases that are hard to guess because no person chose them. This one runs entirely in your browser, uses the Web Crypto API for randomness, and shows the strength of each result in bits of entropy.
People are bad at being random. We reuse pet names, birth years and keyboard runs like “qwerty123”, and attackers build their guess lists from exactly those habits. A random password generator removes the human pattern, so the only way to crack the result is to try a huge number of possibilities.
How to Use the Password Generator
- Pick a mode at the top: Random password for a string of characters, or Passphrase for a set of words.
- For a random password, set the length with the slider or type a number from 4 to 128. The default is 16.
- Choose the character sets: uppercase, lowercase, digits and symbols. Leave “require at least one from every selected set” on if a site insists on mixed characters.
- Tick “exclude look-alikes” if you will ever read the password aloud or copy it from paper, and “exclude ambiguous symbols” if a site rejects brackets, quotes or slashes.
- For a passphrase, choose 3 to 10 words, a separator, and whether to capitalize each word or add a number.
- Check the strength bar and the crack time estimate, then press Copy. Press Regenerate if you want a different one.
- Need several at once? Enter a count from 1 to 50, press Generate list, then use Copy all.
Every option change produces a fresh password straight away, so you can watch how length and character sets move the entropy score.
Random Password or Passphrase Generator: Which Should You Use?
Both are strong when a machine picks them at random. The real difference is who has to type them.
When a random password generator makes sense
A 16-character random password using all four character sets has about 103 bits of entropy. It is short, dense and unreadable, which is fine when a password manager fills it in for you. Use this mode for website logins, shopping accounts and anything you never type by hand.
How the passphrase generator works
The passphrase mode picks words at random from a built-in list of 1,159 common English words, so each word adds about 10.2 bits. Five words give roughly 51 bits and seven words give about 71 bits. A result like “maple-otter-quartz-lagoon-hinge” is much easier to enter on a phone or a TV remote than “x#9Tq!vR2@Lm”.
Passphrases suit the few secrets you have to remember: the master password for your password manager, your computer login and your phone backup. Diceware-style lists such as the EFF long word list have 7,776 words (about 12.9 bits each), so with this smaller list plan on one or two extra words for similar strength.
How Long Should a Password Be?
For a random password kept in a password manager, 16 characters or more is a sensible default. For a passphrase you memorize, aim for 6 or 7 random words. Length does more than symbols do: each extra character from the full set adds about 6.5 bits, while switching from lowercase-only to all four sets adds only about 1.8 bits per character.
US government guidance points the same way. NIST Special Publication 800-63B has favored length over complexity since its 2017 revision, which set an 8-character minimum and recommended that services accept passwords of at least 64 characters. Revision 4, finalized in 2024, says a password used as the only login factor must be at least 15 characters, and that services should not demand composition rules like “one uppercase and one symbol” or force periodic changes without signs of compromise.
Plenty of sites still enforce the old rules, which is why this tool keeps the “require at least one from every selected set” option. It costs almost nothing in strength and saves you a rejected sign-up form.
How Password Strength Is Measured
The strength meter uses entropy, measured in bits. Each extra bit doubles the number of guesses an attacker needs. A password with 60 bits of entropy has about a quintillion (1018) possibilities, and 80 bits has roughly a million times more than that.
What the password strength labels mean
For a random password the formula is length × log2(pool size). With all four sets the pool is 89 characters, so 16 characters × 6.48 bits comes to about 103.6 bits. For a passphrase it is word count × log2(1,159), plus a few bits when you add a number.
| Label | Entropy | Example |
|---|---|---|
| Very weak | Under 28 bits | 5 lowercase letters (23.5 bits) |
| Weak | 28 to 35.9 bits | 7 lowercase letters (32.9 bits) |
| Fair | 36 to 59.9 bits | 8 characters, all sets (51.8 bits) |
| Strong | 60 to 79.9 bits | 12 letters and digits (71.5 bits) |
| Very strong | 80 bits or more | 16 characters, all sets (103.6 bits) |
How the crack time estimate works
The crack time assumes an offline attack at 10 billion (1010) guesses per second, a rough figure for a well-equipped attacker working on a leaked database of fast hashes. It shows the average time, which is half the full search. An 8-character password from all sets falls in about 2 days. At 12 characters, the estimate jumps to roughly 390 thousand years.
Treat the number as a way to compare settings, not a promise. Sites that store passwords with slow hashes such as bcrypt or Argon2 make each guess far more expensive, and online attacks are held back by rate limits and lockouts. The math also assumes the password is truly random. “Summer2024!” mixes four character types but sits near the top of every attacker’s list.
Is This Secure Password Generator Safe to Use?
Yes, because nothing leaves your device. Passwords are generated in your browser with crypto.getRandomValues, the browser’s cryptographically secure random number generator, and the page never sends them anywhere. Nothing is logged or stored, and the tool keeps working if you disconnect from the internet after the page loads.
The generator also avoids a subtle flaw found in some scripts. Mapping a random number onto a character pool with the % operator slightly favors some characters, a problem called modulo bias. This tool throws away out-of-range values and draws again, so every character in the pool has the same chance. Required characters go to random positions through a secure shuffle, so the first character is not always a capital letter.
Where you type the password matters as much as how it was made. Only enter it on pages served over HTTPS. If a login page shows a certificate or protocol error, don’t click past the warning; read up on fixing ERR_SSL_PROTOCOL_ERROR and confirm the site is genuine before you sign in.
Strong Password Tips That Matter Most
- Use a different password for every account. Reuse is how one breach turns into five compromised accounts.
- Keep them in a password manager. It generates, remembers and autofills passwords, and it only fills on the matching domain, which stops many phishing pages.
- Turn on two-factor authentication (2FA) for email, banking and the password manager itself. An authenticator app or a hardware security key is stronger than SMS codes.
- Change a password when a service reports a breach, not on a calendar schedule.
- Never send passwords over email or chat. If you must share one, use the sharing feature in your password manager.
Password Rules for Developers Building Sign-Up Forms
If you build login systems, the NIST guidance above turns into a few concrete rules. Accept at least 64 characters, allow spaces and all printable characters, let people paste so password managers work, and check new passwords against a list of known breached ones instead of demanding symbols.
The field itself should use type="password" with autocomplete="new-password" on sign-up and autocomplete="current-password" on login, which tells browsers and managers when to offer a generated password. An HTML password input builder can produce that markup for you.
Avoid a low maxlength on password fields. A cap of 16 or 20 characters rejects the long passwords this generator produces and pushes users back toward weak ones.
FAQs
Yes, if it creates passwords locally in your browser with a cryptographic random source and sends nothing to a server. This one uses crypto.getRandomValues and works offline. Avoid generators that fetch passwords from a remote server.
Use at least 16 random characters for passwords stored in a password manager. NIST’s 2024 guidance sets 15 characters as the minimum for single-factor passwords. For memorized passphrases, use six or seven random words.
A passphrase is easier to type and remember, while a random password packs more strength into fewer characters. Six random words from this tool give about 61 bits; 16 mixed characters give about 104 bits.
Reddit users in r/privacy and r/cybersecurity commonly recommend the generator built into a password manager such as Bitwarden, 1Password or KeePassXC, because it creates and saves the password in one step.
Only when there is a reason, such as a breach notice or suspected compromise. NIST SP 800-63B advises against forced periodic changes because they push people toward predictable patterns like adding one to a number.
