Strong Password Generator
Create truly random passwords and easy-to-type passphrases right in your browser. See how strong each one is in bits of entropy and estimated time to crack.
Runs in your browser — nothing is uploaded Free, no limits
Options
Test your own password
Type a password you use to see how it compares with a generated one.
How to use the Password Generator
- Choose Password for random characters or Passphrase for random words.
- Set the length (or number of words) and the characters to include.
- Check the strength meter — aim for at least 60 bits, 80+ for important accounts.
- Click Regenerate until you like one, then Copy it into your password manager.
- Need many? Set "How many" up to 50 and download the list.
Frequently asked questions
How random are these passwords?
They use crypto.getRandomValues, the browser's cryptographically secure random generator, with rejection sampling so every character is equally likely (no modulo bias). Math.random is never used.
How long should a password be?
For accounts protected by a password manager, 16+ random characters (about 100 bits with all character types) is plenty. Anything above roughly 80 bits of entropy is beyond the reach of offline brute-force attacks today.
What is password entropy?
Entropy measures how many guesses an attacker needs, in bits: each extra bit doubles the work. A random password has length × log2(alphabet size) bits — 16 characters from 94 symbols is about 105 bits.
Are passphrases secure?
Yes, if the words are chosen randomly. Each word from this tool's list of 1,400+ words adds about 10.5 bits, so five words plus a number come to about 61 bits and six words alone are about 63 bits — easy to type and remember, and far stronger than a human-chosen password.
What does "exclude look-alikes" do?
It removes characters that are easy to confuse when reading or typing: capital I, lower-case l, the digit 1, capital O and the digit 0. It slightly lowers entropy, which the meter accounts for.
Do you store or see my passwords?
No. Passwords are generated in your browser, never sent over the network, never logged, and disappear when you close the page.