How to use the Password Generator
- Choose Password, Passphrase or PIN.
- Set the length (or number of words) and the character types you need — 16+ characters with all four types is a good default.
- Watch the strength meter: aim for at least 80 bits of entropy for important accounts.
- Click Copy and save it in your password manager. Use ↻ New for another, or Generate list for many at once.
What makes a password strong?
A strong password is long, random and unique to one account. Strength is measured as entropy — the number of guesses an attacker would need, expressed in bits. Every extra bit doubles the work. A password chosen uniformly at random from a pool of N characters with length L has L × log₂(N) bits of entropy: a 16-character password from all 94 printable ASCII characters has about 105 bits, far beyond any brute-force attack. Human-chosen passwords like Summer2026! look complex but are among the first patterns cracking tools try.
How this generator works
- Cryptographically secure randomness. Characters are picked with
crypto.getRandomValues(), the browser's CSPRNG, using rejection sampling so every character is equally likely (no modulo bias).Math.random()is never used. - Nothing leaves your device. Passwords are generated in this page, are not sent to a server, not stored in local storage and never put in the URL. Only your settings (length, character types) are remembered.
- “At least one of each type” regenerates until every selected type appears, which keeps the result uniformly random among passwords that meet typical site rules.
Password vs passphrase
| Type | Example | Entropy |
|---|---|---|
| Random password, 12 chars, 94 symbols | q7#Lr!x2Vb$e | ≈ 79 bits |
| Random password, 20 chars, 94 symbols | 8w$Kt@pZ… | ≈ 131 bits |
| Passphrase, 6 words (EFF short list) | cork-fling-dried-ivy-mocha-purse | ≈ 62 bits |
| Passphrase, 8 words | cork-fling-dried-ivy-mocha-purse-oval-zippy | ≈ 83 bits |
| PIN, 6 digits | 402917 | ≈ 20 bits |
Passphrases are easier to remember and type on a phone — ideal for your password-manager master password or device login. Random character passwords pack more entropy into fewer characters and are best for everything stored in a password manager.
How the crack-time estimate is calculated
The estimate assumes an offline attack on a stolen, fast-hashed password database at 10 billion guesses per second — well within reach of a single modern GPU attacking fast, unsalted hashes such as MD5 or SHA-1 — and reports the average time to find the password (half the search space). Slow hashes like bcrypt or Argon2 make real attacks thousands of times slower; online login forms with rate limiting, slower still. Entropy here is exact for generated passwords; it does not apply to passwords you invent yourself.
Best practices
- Use a different password for every site and store them in a password manager.
- Turn on two-factor authentication (preferably passkeys or an authenticator app) wherever possible.
- Current NIST guidance (SP 800-63B) favours length over forced complexity and advises against routine password expiry.
Need a random identifier instead of a secret? Use the UUID Generator; to hash a value, try the Hash Generator.
Tools that pair well with the Password Generator
- Base64 Encode / Decode — Convert text to Base64 and back with full UTF-8 support (accents, emoji), switch to URL-safe Base64, or drop a file to get its Base64 string or data URI.
- JWT Decoder — Paste a JSON Web Token to inspect its header and payload, check when it expires and verify its signature.
- Soft Hyphen Generator — Stop long words like “Versicherungsleistungen” from overflowing on mobile: insert invisible soft hyphens automatically or at your own break points, then copy the result.
- Smart Quotes to Straight Quotes — Code copied from Slack, Notion, Word or a blog won’t run?
Frequently asked questions
Is it safe to generate a password online?
crypto.getRandomValues() and is never transmitted, logged or saved. You can even disconnect from the internet after the page loads and it keeps working.How long should my password be?
What does “exclude look-alikes” do?
I, l, 1, |, O, 0 and o. It slightly reduces entropy per character, so add a character or two to compensate.Why does a website reject my generated password?
<>&\'") in “Exclude these characters”.