password generator
create strong, random passwords with the length and character types you choose. they are generated on your device and never leave it.
runs on your device · free · no sign-up
loading tool…
how to password generator
- pick a mode: random, pronounceable or memorable words.
- set the length and the character types, and choose how many passwords you want.
- check the strength meter and the estimated crack time.
- copy one password, copy all, or download the list as a .txt file.
a password is strong when it is long and truly random. length matters more than clever symbols: each extra character multiplies the work for an attacker, while swapping a letter for a symbol adds only a little. for accounts that matter, use at least 16 characters and a different one for each site, stored in a password manager.
people are poor at being random, which is why generators exist. here every character is drawn with the browser crypto random number generator, and values are rejected and redrawn when needed so no character is more likely than another. nothing is stored, logged or sent anywhere, and the page works offline once loaded.
some places limit what you can type. wifi passwords and tv logins are painful with symbols, so a long mix of letters and digits is the better choice. for something you need to remember, four or five random words are both easier and stronger than a short complex string. use the bulk option for test accounts or when you set up many users.
features
- random, pronounceable and memorable-word modes
- bulk generate 10, 50 or 100 passwords, copy all or download .txt
- strength meter with entropy in bits and a plain explanation
- crack time at three stated guess rates
- optional no look-alike characters (I, l, 1, O, 0)
- unbiased secure randomness with crypto.getRandomValues
popular uses
frequently asked questions
how are the passwords generated?
we use crypto.getRandomValues, the same cryptographically secure random source your browser uses for encryption keys, with no modulo bias.
how long should a password be?
at least 16 characters for important accounts. the strength meter shows the entropy in bits; above 80 bits is very strong.
is the password saved or sent anywhere?
no. generation happens in your browser and nothing is uploaded or stored.
what do the bits of entropy mean?
entropy measures how many guesses an attacker needs. every extra bit doubles it. a random password of 16 letters and digits has about 95 bits, which would need far more than a human lifetime to guess even at billions of guesses per second.
how is the crack time estimated?
we take half of all possible passwords, the average case, and divide by a stated guess rate: 1,000 per second for a rate-limited login, 100,000 per second for a stolen database with a slow hash, and 10 billion per second for a fast hash on gpus. these are rough scenarios, not promises.
when should i use pronounceable or memorable mode?
use them for passwords you have to read out or type on a tv or console, or a master password you must remember. they need more characters to match a fully random password, so the meter shows the real strength. for everything else, use random and a password manager.