Password generator
Strong random passwords or memorable passphrases, generated securely on your device. Never sent anywhere
Tips
Longer is stronger. Random character passwords pack the most strength per character; memorable word passphrases (like maple-river-otter-7) are easier to type and remember. Either way, use a unique password per site and store them in a password manager. Everything is generated locally with your browser's secure random generator and never transmitted.
How to use the password generator
- Pick a mode: Random characters for maximum strength per character, or Memorable words for a passphrase you can actually type and remember.
- In character mode, set the length (6–64, default 16) and tick the sets to draw from: a–z, A–Z, 0–9, symbols. Every ticked set is guaranteed to appear at least once.
- Turn on No look-alikes if someone will read or retype the password — it removes the confusable characters O, 0, I, l, 1, S, 5, B and 8.
- In word mode, choose 2–8 words, a separator (hyphen, dot, underscore, space or none), and whether to capitalize and append a number (0–99) and a symbol.
- Watch the meter: it shows the password's entropy in bits — under 40 rates Weak, 40–59 Fair, 60–89 Strong, 90+ Very strong.
- Click Copy, or ↻ for a fresh one — changing any option regenerates instantly.
Common uses
- Create a random password for an important account — the 16-character default with all four sets on rates about 103 bits, well into Very strong — and store it in your password manager.
- Generate a Wi-Fi passphrase like Maple-River-Otter-42! that guests can read off a card and type on a phone or TV keyboard without mistaking 0 for O.
- Make throwaway credentials for test accounts, staging environments or database seeds.
- Satisfy a picky signup form: tick exactly the sets the site allows; each is guaranteed to appear.
- Produce a master passphrase for a password manager or disk encryption — one secret worth making both long and memorable.
Tips & limitations
- Length beats cleverness. With all four sets on, each character adds about 6.4 bits, so going from 12 to 16 characters adds more strength than any symbol rule.
- The word list has 280 words, so each word contributes ~8 bits. The default 4 words + number + symbol scores about 42 bits — Fair. For anything important, use 6–8 words.
- No look-alikes shrinks the character pool slightly (86 → 77 with all sets on). If you use it, add a character or two of length to compensate.
- The meter rates how the password was generated, not how a website will judge it — some sites cap length or reject certain symbols, so trim the options to match their rules.
- This is a generator, not a strength checker: you can't paste an existing password in to have it scored. Reusing an old password anywhere is the real risk no meter can fix.
How it's built & why it's safe
Every password is drawn from your browser's cryptographically secure crypto.getRandomValues() — not the predictable Math.random(). Random values are rejection-sampled so no character is statistically favored (no modulo bias), required sets are guaranteed by construction, and the result is shuffled with a Fisher–Yates pass driven by the same secure source. Generation is 100% local: nothing is sent, logged or stored, and the strength meter is computed from the same math (pool size and length) that generated the password.
Related tools: Text Encryptor · One Time Link · UUID Generator
Further reading: What makes a password strong? Entropy, length and passphrases · How to share a password or secret safely
Frequently asked questions
Are these passwords safe to use?
Yes. They come from crypto.getRandomValues, the browser's cryptographically secure random number generator, with rejection sampling so every character is equally likely. Nothing is transmitted or saved — the password exists only where you paste it.
Random characters or a memorable passphrase?
Random characters pack the most strength into the fewest keystrokes — ideal when a password manager does the typing. A word passphrase is better for anything you type by hand, like a laptop login or Wi-Fi key. Either way, longer is stronger.
What do the bits in the strength meter mean?
Entropy bits count how many guesses an attacker would need — each extra bit doubles the search space. The meter rates under 40 bits Weak, 40–59 Fair, 60–89 Strong and 90+ Very strong.
Why does the passphrase mode score lower than random characters?
Each word is one pick from a 280-word list, worth about 8 bits, so a 4-word phrase carries roughly the entropy of a 5-character random password. Add words (6–8) to close the gap; the number and symbol options add about 10 bits together.
What does the No look-alikes option do?
It removes characters that are easy to confuse when read aloud or retyped: O and 0, I, l and 1, S and 5, B and 8. Use it for passwords someone will transcribe — the slight drop in pool size is easily offset by one extra character.
Do I still need a password manager?
Yes — a generator solves creation, not storage. The strongest password in the world doesn't help if it's reused across sites; generate a unique one per account and let a manager remember them.