Password generator
Strong passwords and passphrases, generated in your browser.
FreeRuns in your browserNo signupUpdated 2026-10-29
Generated with crypto.getRandomValues in your browser. Nothing is sent or stored, and the page keeps no history.
Strength
Very strong
86 possible characters per position
Entropy
129 bits
Higher is better; 60+ is fine for most accounts
Time to crack
775,952,366,757 billion years
Offline, 10 billion guesses per second
Advice
- Use a different password for every account and keep them in a password manager.
- Length beats complexity: a 5-word passphrase is stronger than 10 random symbols and far easier to type.
- Turn on two-factor authentication wherever it is offered.
About this tool
How it works and how to read the result.
Need this done for you?
Website care & maintenance
Hosting, updates, backups and fixes, handled for you.
See the serviceWhat it does
The password generator makes random passwords from the character sets you choose, or passphrases from a built-in list of common words, using the browser's cryptographic random source. Each batch shows its entropy in bits, a strength badge and a rough time to crack at ten billion guesses per second. Random passwords always include at least one character from every selected set, and an option avoids look-alike characters such as capital I, lowercase l and the digit 1. Passphrases can be capitalised, separated by a hyphen, dot, underscore or space, and end with a number.
How to use it
- Pick a random password or a passphrase.
- For passwords, set the length and tick the character sets the site allows.
- For passphrases, choose the word count and separator.
- Set how many to generate, then click "Generate again" until you see one you like.
- Copy it into your password manager, not into a note or an email.
How to read the result
Entropy is the honest measure. A 20-character password from all four sets uses a pool of 86 characters and gives about 128 bits, far beyond what any attacker can search. Drop to 8 characters of lowercase letters only and you have 38 bits, which the estimate shows cracking in about 10 seconds.
Fair means 40 to 60 bits: acceptable for a low-value account with rate limiting, weak for anything that matters. Strong starts at 60 bits, which takes years at the assumed speed. Very strong, at 80 bits and above, is where a stolen hash stays safe for the life of the account.
A 6-word passphrase with a number from the 215-word list reaches about 53 bits, and 8 words about 69. If you need more from a passphrase, add words rather than symbols; each word adds about 7.7 bits.
Strength does not help if the password is reused. One password per account, kept in a manager, with two-factor authentication where it is offered, is what we set up for clients under website maintenance. For checksums rather than secrets see the hash generator.
Questions
Frequently asked.
Is a passphrase really as strong as a random password?
Five words chosen at random from the 215-word list here give about 39 bits, so use six or more words and add the number. Twelve random characters from the full 86-character set give about 77 bits. Length matters more than symbols, and a passphrase is far easier to type on a phone.
Can anyone see the passwords this page makes?
No. Generation uses crypto.getRandomValues in your browser, nothing is sent to a server, and the page keeps no history. Once you close or reload the tab the passwords are gone, so copy the one you want into your password manager first.
What does the crack-time estimate assume?
An offline attacker with the password hash who can test 10 billion guesses a second, which is a fast GPU rig against a weak hash. Against a properly salted bcrypt or Argon2 hash the real figure is thousands of times longer. Online logins with rate limits are slower still.
Your next move
Like what you see? Tell us about it.
A process that takes too long, a website that undersells you, or an idea ready to take shape. Tell us where you are and we will suggest a useful next step.
India · Working with clients worldwide