Generate strong random passwords or memorable passphrases using cryptographically secure randomness, and check any password's strength — 100% client-side, nothing is ever sent anywhere.
Choose your options and click Generate
Choose your options and click Generate
Analyzed entirely in your browser — nothing is sent anywhere.
Type a password to see its strength analysis
This free password generator online bundles three things people need for password security in one tool: a secure password generator and random password generator for producing a strong password generator-grade string, a memorable passphrase generator built on diceware passphrase principles, and a password strength checker that scores any password you type. Everything runs entirely inside your browser — no password, passphrase, or keystroke is ever sent to a server, logged, or stored, so it also works as a private, offline-friendly password security checker.
The Password Generator lets you generate random password strings from your chosen character types (uppercase, lowercase, numbers, symbols) using the browser's crypto.getRandomValues() cryptographically secure random source with rejection sampling, avoiding the bias that weaker generators like Math.random() can introduce. The Passphrase Generator strings together several random dictionary words — the same diceware passphrase approach used by security professionals — optionally capitalized and numbered, for a secure passphrase that's both strong and easy to type from memory. The Strength Checker doubles as a password entropy calculator and crack time calculator: it estimates entropy in bits (length × log₂ of the character set size) and flags known common passwords, which are crackable almost instantly by a real crack time calculator estimate regardless of their apparent complexity.
This generator is useful any time you need a new credential: signing up for an email or banking account, an IT admin provisioning employee logins, a developer generating an API key or secret, or anyone replacing a password after a data breach notification. The Passphrase Generator suits master passwords and any account you need to type by hand, while the Strength Checker is a quick way to sanity-check a password you already have in mind before committing to it.
Weak, reused, or predictable passwords remain one of the leading causes of account compromise. A single strong, unique password per account — generated randomly by a secure password generator rather than chosen by a human, who tends to pick predictable patterns — closes off the most common attack paths, including credential stuffing and dictionary attacks.
Every character and word is chosen using crypto.getRandomValues() — the same secure random source used by password managers — with rejection sampling to eliminate bias, rather than the weaker Math.random().
Entropy (in bits) measures how unpredictable a password is: length × log₂(character set size). Crack time estimates assume a fast offline attack and roughly double for every extra bit of entropy.
A passphrase built from several random dictionary words can carry more entropy than a shorter complex password, while being much easier for a human to remember and type accurately.
Generation and analysis run entirely in client-side JavaScript. No password, passphrase, or keystroke is transmitted to a server, logged, or stored — refreshing the page discards everything.
From choosing your options to a password ready to use
Enter a length between 4 and 64 characters in the Password Length field. 16 or more characters is recommended for accounts you want strong, long-term protection on.
Check the boxes for uppercase letters, lowercase letters, numbers, and symbols you want included. Optionally enable "Exclude ambiguous characters" to drop visually similar characters like 0, O, 1, l, and I if the password needs to be typed or read manually.
The generator draws each character from your selected character sets using the browser's cryptographically secure crypto.getRandomValues() source, guarantees at least one character from every checked type, then shuffles the result so the guaranteed characters aren't predictably placed.
Click the "Copy" button next to any generated password to copy it straight to your clipboard, ready to paste into an account signup form or, ideally, straight into your password manager.
Not happy with a result, or need a fresh one for another account? Click "Generate" again — every click produces a brand-new, independent password from your selected options, with no relationship to the previous result.
Comparing two common password choices using the calculator's own entropy and crack-time model
Suppose you generate a 12-character password with uppercase letters, lowercase letters, and numbers checked, but symbols left unchecked.
Now suppose you generate a 16-character password with uppercase, lowercase, numbers, and symbols all checked.
Explanation: Adding four more characters and one more character type (symbols) took this example from about 71 bits to about 105 bits of entropy — a difference of roughly a billion-billion-fold in the size of the keyspace an attacker would need to search, because each extra bit doubles the possibilities. This illustrates why both length and character variety matter, and why the calculator defaults to a 16-character length with all four types checked.
What actually makes a password hard to guess — and how this tool's strength indicator works
A password's real-world strength comes down to three things: how long it is, how many different types of characters it draws from, and how unpredictable the specific combination is. Length and character variety together determine the size of the "keyspace" — every possible password an attacker would have to consider — while unpredictability determines whether an attacker can skip most of that keyspace by guessing likely patterns first (common words, keyboard sequences, or previously breached passwords) instead of searching it exhaustively.
This calculator measures unpredictability using entropy, expressed in bits, with the formula entropy = length × log₂(character pool size). Each additional bit of entropy doubles the number of possible combinations, so entropy grows exponentially with length — which is why a longer password is almost always stronger than a shorter one, even if the shorter one uses more character types.
Both the Password Generator's strength bar and the Strength Checker use the same entropy-based bands to label a result:
| Entropy (bits) | Label Shown | General Meaning |
|---|---|---|
| Below 28 | Very Weak | A very small keyspace — guessable in a short amount of time |
| 28 – 35 | Weak | Still a limited keyspace; vulnerable to a determined automated attack |
| 36 – 59 | Fair | Reasonable for low-stakes or short-lived accounts, not ideal for sensitive ones |
| 60 – 79 | Strong | Solid protection for most everyday and financial accounts |
| 80 and above | Very Strong | Well beyond what brute-force guessing can realistically reach |
Note that entropy alone doesn't capture everything — a password can have decent mathematical entropy and still be weak in practice if it happens to be a known common password (like "password123"). That's why the Strength Checker separately cross-references your input against a list of frequently breached and reused passwords and caps the effective strength when it finds a match, regardless of the calculated bit count.
Where a random, cryptographically secure password or passphrase genuinely helps
Generate a unique, strong password the moment you sign up for a new email provider, rather than reusing one from another account.
Replace a banking or investment account password with a long, high-entropy one, especially after a routine password-rotation reminder.
Generate unique, policy-compliant initial passwords for new hires or provisioned systems without reusing predictable defaults.
Produce a random string of the right length and character set for an API key, webhook secret, or environment variable.
Replace a router's default or weak Wi-Fi password with a long, random one that's still practical to share and re-enter on new devices.
Generate a strong password for a school email, learning portal, or library account that meets a school's password policy.
Create one-off, disposable passwords for guest Wi-Fi, shared demo accounts, or short-lived test logins.
Use the Passphrase Generator to create a strong, memorable master password or master passphrase for a password manager vault.
Set a unique password when creating a new social account instead of reusing a password from another site.
Immediately generate a fresh, unrelated password for any account flagged in a data-breach notification.
Generate a memorable passphrase for a shared streaming, smart-home, or family account that's easy for multiple people to type correctly.
Create strong, unique passwords for website admin panels, domain registrars, and business email accounts.
Run a password you're already considering through the Strength Checker before committing to it on a new account.
Use "Exclude ambiguous characters" when a password will be printed, handwritten, or read aloud, to avoid transcription errors.
What this password generator does well, and where good security habits still matter
General, order-of-magnitude guidance for an offline brute-force attempt — not a precise prediction
| Length & Composition | Approx. Entropy | Approx. Time to Brute-Force* |
|---|---|---|
| 6 characters, lowercase only | ~28 bits | Instant to a few minutes |
| 8 characters, lowercase only | ~38 bits | Seconds to hours |
| 8 characters, all four types | ~52 bits | Days to a few years |
| 10 characters, all four types | ~65 bits | Centuries |
| 12 characters, all four types | ~79 bits | Many centuries |
| 16 characters, all four types | ~105 bits | Far beyond any practical timeframe |
*Estimates assume a sustained offline attack at roughly 10 billion guesses per second — a commonly cited benchmark, not a fixed real-world figure — and no reuse of a known common password. Actual crack times vary with attacker hardware, the specific hashing/storage method a service uses, and whether the password appears in a breached-password list, so treat this table as a directional guide rather than an exact forecast.
Summary: This password generator produces cryptographically random passwords and passphrases entirely in your browser, with a built-in strength checker showing entropy and estimated crack time — free, private, and with nothing ever transmitted to a server. Pair a strong generated password with a reputable password manager and multi-factor authentication for the most complete protection.
Common questions about password security
Official guidance to complement this tool — not a substitute for your organization's own security policy
Explore other utility tools