Free security tool
Create cryptographically random passwords, EFF-style passphrases, and PINs entirely in your browser. Copy results into your password manager—nothing is uploaded or stored on our servers.
Wordlist: 2,048 entries from EFF large wordlist, CC BY 3.0.
Output
Crack-time assumes an offline attacker averaging half the keyspace at 10 billion guesses per second.
Modern guidance from NIST Special Publication 800-63B emphasizes that humans are bad at inventing secrets and good at reusing them. Instead of forcing arbitrary mixes of symbols and quarterly rotation, organizations are encouraged to allow long passphrases, support password managers, and block known-breached passwords. A 20-character random password drawn from upper, lower, and digits already exceeds the guessing power of most offline attacks; adding length is almost always more effective than adding one more punctuation rule.
This generator follows that philosophy: defaults favor length (20 characters), optional symbols, and transparent entropy math so you can see what you are getting. When a website caps length, use the maximum it allows and store the result in a manager rather than shortening it to something memorable.
Every character and word is chosen with crypto.getRandomValues, the browser’s cryptographically strong random source. We never use Math.random() for secrets. When mapping random bytes to an index in a character pool, we use rejection sampling so that modulo bias cannot favor low indices. After picking one guaranteed character from each enabled set, we fill the remainder and shuffle with Fisher–Yates, again using unbiased indices.
That matters because biased generators produce passwords that look random but skew toward certain letters, shrinking the effective search space attackers must try. You do not need to trust our prose: the logic runs locally and can be reviewed in the page source.
Random strings maximize entropy per character and fit sites that allow paste and long fields. Passphrases trade character density for memorability: several unrelated words from a large list (we embed 2,048 words from the EFF large wordlist) can reach high bit strength while remaining typable. PINs are appropriate only where the threat model is limited—device unlock attempt throttling, not protecting email or banking alone.
Use the mode that matches the service’s rules and your storage habit. If you will not use a manager, a long passphrase you can rehearse may beat a short complex password you will forget and reset.
Entropy (measured in bits) is a log-scale estimate of how many guesses an ideal attacker might need in the worst case, assuming your password was generated randomly from the stated pool or wordlist. The meter and labels on this page map bit ranges to everyday language: weak, fair, good, strong, and excellent. These are models, not guarantees—real attackers use dictionaries, leaked lists, and site-specific rules.
Crack-time figures assume an offline attacker trying 10 billion guesses per second against the full entropy of your settings (half the keyspace on average). That rate is illustrative—faster clusters exist, but throttled online login is far slower. Treat the estimate as order-of-magnitude, not a promise.
P@ssw0rd substitutions).Some systems or fonts make O and 0 hard to tell apart. Toggle “exclude similar” to drop O0Il1| from pools. “Exclude ambiguous” removes symbols that break shells or legacy forms—brackets, quotes, and slashes—while keeping a solid set of safe punctuation. Custom symbol fields let you match a picky site’s allowed list exactly.
The checker tab analyzes text you paste without sending it to our servers. Still, never type your real production passwords into untrusted websites. Use this tab for education, test strings, or patterns you are about to change. It flags short length, small character pools, keyboard walks, and repeated characters.
Passwords, passphrases, PINs, and checker input stay in page memory. We do not write them to localStorage, cookies, or analytics events. Non-sensitive UI toggles (length, character sets, tab choice) may be remembered locally for convenience. Closing the tab clears generated secrets unless you copied them elsewhere—clear the clipboard when finished on shared machines.
Batch mode (count 1–20) is useful when you are onboarding devices, rotating API keys for personal projects, or filling a password manager vault after a breach notice. Each line is independent: its own random bytes, its own shuffle. Copy all joins them with newlines so you can paste into a spreadsheet or manager import flow. Remember that bulk generation does not mean reuse—every account still deserves its own secret.
Strong generation does not help if you deliver the password to an attacker. Type or paste new secrets only into the legitimate site or your manager. Support agents who ask for your password are not following safe practice. Store backup and two-factor recovery codes with the same care as passwords—often they are equivalent keys. If you must share access, use vendor-built delegation (family plans, org roles) instead of texting a password.
Passphrase mode samples from 2,048 words taken from the EFF large wordlist (CC BY 3.0). The full list contains 7,776 words; this subset preserves usability while meeting high entropy when you choose enough words.
It draws random bytes with the Web Crypto API (crypto.getRandomValues), maps them onto your chosen character sets without modulo bias, ensures each selected set appears at least once, then shuffles the result.
Generation and strength checks run entirely in your browser. Passwords are not sent to our servers and are not written to cookies or analytics. Clear the page when you are done.
For random passwords, 16+ characters is a solid default; 20+ is better for high-value accounts. Passphrases should use enough words to reach similar strength. Length beats complex short passwords.
Unpredictability and length. Prefer a large random character pool or a long random passphrase. Avoid reused passwords, names, dates and keyboard patterns.
A random password is dense and hard to type; a passphrase of several random words is easier to remember at similar entropy. Both work when generated properly and stored in a password manager.
Symbols enlarge the character pool, which helps if length is capped by a site. If a site allows long passwords, length alone can be enough. Follow each site’s rules.
Entropy estimates how many guesses an attacker needs in the worst case, measured in bits. This meter uses pool size and length (or wordlist size for passphrases). It is a model — not a guarantee.
Yes. Managers generate, store and autofill unique passwords so you do not reuse them. Modern guidance encourages managers and paste/autofill.
Change a password when it may be compromised, reused, or shared — not on a fixed calendar. Forced periodic rotation often leads to weaker patterns.
Use the passphrase mode with enough random words, or let a password manager remember a long random string. Do not invent “clever” substitutions of dictionary words alone.