Password & Passphrase Generator
Create a strong random password, a memorable passphrase or a PIN. Every result shows its exact entropy and how long it would take to guess under three realistic attacks, so you can see what a length or setting is actually worth. Generated with your browser's cryptographic random source, and never sent anywhere.
Options
What Password Generator does
Truly random, with no bias
Characters come from crypto.getRandomValues, never Math.random, and are picked by rejection sampling so no character is even slightly more likely than another.
Passphrases you can remember
Words drawn from the EFF's diceware list — six of them are about as hard to guess as a random ten-character password, and far easier to type on a TV remote.
Strength you can check
The strength shown is the exact entropy of the generator's output, not a guess from pattern-matching. Change a setting and the figure moves to match.
Crack times that mean something
One number is not enough. You see the time to guess through a rate-limited login, a leaked database with a slow hash, and a leaked database with a fast one.
Fits awkward site rules
Drop look-alike characters like l, 1 and O, or exclude the exact symbols a website refuses to accept.
Nothing leaves the page
Passwords are generated in your browser, shown once and forgotten. They are never uploaded, logged, stored or put in the address bar.
How it works
Pick a type
Password for a password manager, passphrase for something you must type or remember, PIN for a keypad.
Adjust the settings
Set the length or number of words and choose which characters are allowed.
Check the strength
Aim for at least 60 bits for anything that matters and 80 or more for a master password.
Copy it
Copy one, or generate a batch and copy them all at once.
Cheatsheet
The tokens you reach for most, at a glance.
< 28 bitsVery weak — guessable online within days28–39 bitsWeak — a PIN or short password; fine only behind lockouts40–59 bitsReasonable — resists online attacks, not a leaked fast hash60–79 bitsStrong — good for everyday accounts80+ bitsVery strong — use for master passwords and encryptionHow people use it
New accounts
A unique random password for every site, saved straight into your password manager.
Master passwords
A long passphrase for the one password you have to remember — your password manager, disk encryption or computer login.
Wi-Fi and devices
A passphrase that guests can type on a phone, or a PIN for a lock, card or router admin page.
Secrets and test data
Generate a batch of strong values for service accounts, API test users or seed data.
Frequently asked questions
Are these passwords really random?
Yes. They come from your browser's cryptographic random number generator (crypto.getRandomValues), the same source used for encryption keys. Each character is chosen by rejection sampling, which avoids the small "modulo bias" that makes some characters slightly more likely in naive generators.
How is the strength worked out?
It is the exact entropy of the generator: log2 of how many different results the current settings could produce. A 16-character password from 90 possible characters has about 104 bits. This is a stronger claim than a strength meter makes — it describes how the password was made, which an attacker cannot shortcut. It does not apply to a password you invented yourself.
What do the crack times assume?
The average time to guess — half the possibilities — at three speeds: 10 guesses a second against a rate-limited login, 10,000 a second against a leaked database hashed with bcrypt, and 100 billion a second against a fast hash such as MD5 on one high-end graphics card. Real attackers vary, so read them as orders of magnitude.
Why does "at least one of each type" lower the entropy slightly?
Because it rules some passwords out. Every password that happens to have no digit is now impossible, so there are fewer possible results. The loss is under one bit for a sensible length — well worth it for sites that insist on each type. The tool counts it exactly rather than ignoring it.
Is a passphrase as strong as a password?
It depends on the number of words. Each word from the EFF short list adds about 10.3 bits, so six words give roughly 62 bits — comparable to a random ten-character password — and eight words give about 83. Passphrases are longer to type but much easier to remember and to enter on a phone.
Where does the wordlist come from?
It is the Electronic Frontier Foundation's Short Wordlist #1 — 1,296 short, common, easy-to-type words — used under the CC BY 3.0 US licence. It is included unchanged, because removing words would change the entropy the page reports.
Are generated passwords saved or sent anywhere?
No. They are generated in your browser and exist only on this page. Nothing is uploaded, logged, stored in your browser or added to the URL, and reloading the page discards them. Save the one you use in a password manager.
Last updated 2026-09-12