Nothing leaves your device
Every password is built in your own browser using the Web Crypto API. There is no request to a server, no analytics event carrying the value, and nothing written to storage. Close the tab and it is gone.
Strong Password Generator
A free password generator that builds truly random passwords, memorable passphrases and secure PINs — then shows you exactly how strong each one is in bits of entropy and estimated crack time. Nothing is sent anywhere, logged or stored.
- No sign-up, no ads
- Cryptographically secure randomness
- Works offline once loaded
Password generator tool
Your password
Random
Very strong
0 bits of entropy
A PIN has only ten possible values per digit, so length is the only lever you have. This generator also rejects the straight sequences and repeated-digit patterns that PIN-guessing lists try first.
Need several at once?
Why this password generator beats the usual ones
Most generators hand you a string of characters and a vague green bar. This one shows you the maths behind the bar, gives you a memorable option for the passwords you actually have to type, and never touches a server.
Real entropy, not a mood ring
Strength is reported in bits of entropy calculated from your actual settings, alongside an estimated offline cracking time. You can see instantly what adding four characters or one more word really buys you.
Three modes in one tool
Fully random for anything a password manager will remember for you, a passphrase for the handful you type by hand, and a PIN for devices and cards. Most competing pages only do the first.
No modulo bias
Random characters are drawn using rejection sampling, so every character in the set is equally likely. Generators that use a plain remainder operation quietly skew towards the start of the alphabet.
Built mobile-first
Full-size tap targets, a slider you can actually drag with a thumb, no layout shift while the page loads, and a copy button that works on iOS and Android instead of silently failing.
Awkward site rules handled
Turn off symbols for banks that reject them, skip look-alike characters for passwords you will read off a screen, or force every character to be unique. The strength readout updates for each choice.
How to use the password generator
- Pick the type you needUse Random for anything stored in a password manager, Passphrase for logins you type from memory, and PIN for phones, SIM cards and door codes.
- Set the lengthDrag the slider. Sixteen characters is a sensible floor for a random password, and twenty or more for email, banking and anything holding your other accounts.
- Match the site rulesSwitch character sets off only when a site forces you to. Every set you remove shrinks the search space, and the entropy readout shows you the cost as you go.
- Copy it and store it properlyPress copy, paste it into the account you are creating, and save it in a password manager rather than a note or your memory. Then never reuse it anywhere else.
How long would it take to crack your password?
Entropy is measured in bits, and each extra bit doubles the work an attacker has to do. The figures below assume an offline attack against a fast, poorly protected hash at roughly 100 billion guesses per second, which is the realistic worst case after a company leaks its password database.
| Password | Character set | Entropy | Time to crack |
|---|---|---|---|
| 6 digits (PIN) | 10 | 20 bits | Instant |
| 8 letters and numbers | 62 | 48 bits | Under an hour |
| 4-word passphrase | 430 words | 35 bits | Minutes |
| 12 mixed characters | 86 | 77 bits | About 30,000 years |
| 6-word passphrase | 430 words | 53 bits | Around a day |
| 16 mixed characters | 86 | 103 bits | Longer than the universe has existed |
| 20 mixed characters | 86 | 129 bits | Effectively uncrackable |
These are ceilings, not guarantees. A password is only as strong as its weakest exposure: if it is reused on a site that gets breached, or typed into a convincing fake login page, its entropy stops mattering entirely. That is why recognising a phishing email and turning on two-factor authentication matter just as much as length does.
What actually makes a password strong
The advice most people absorbed in the 2000s, swapping letters for symbols and changing everything every 90 days, has since been retired by NIST. Here is what replaced it.
Length beats complexity
Adding one character to a mixed-case password with numbers and symbols multiplies the search space by about 86. Replacing an a with an @ multiplies it by roughly nothing, because every cracking tool tries that substitution first.
Uniqueness beats memorability
The most common way accounts get taken over is credential stuffing: attackers replay usernames and passwords leaked from one site against hundreds of others. A perfect password reused twice is a weak password.
Randomness has to be machine-made
People pick patterns without realising it, from keyboard walks to birth years to a capital letter only at the start. Any generator worth using draws from a cryptographic source, so there is no pattern to learn.
Stop rotating for no reason
Forced expiry pushes people towards predictable increments, where Summer2025 simply becomes Summer2026. Change a password when there is a reason to: a breach, a shared device, a suspicion.
You need somewhere to put them
Strong unique passwords are unusable without a vault. A password manager is the piece that makes all of this practical, and it becomes the only password you have to remember.
A second factor covers the rest
Even a flawless password can be phished. Passkeys or an authenticator app mean a stolen password on its own is not enough to get into your account.
Password generator FAQs
Is this password generator safe to use?
Yes. The generator runs entirely as JavaScript inside your browser and uses the Web Crypto API, the same cryptographically secure random source browsers use for encryption keys. Your password is never sent over the network, never written to cookies or local storage, and is not visible to this website. Once you close the tab it no longer exists anywhere except wherever you chose to save it.
How long should my password be?
For a random password stored in a password manager, 16 characters using upper case, lower case, numbers and symbols is a strong baseline, and 20 or more is better for email, banking and any account that can reset your other accounts. If you have to type it from memory, use a passphrase of at least six words instead. Anything under 12 characters is realistically crackable if the site storing it is ever breached.
Are passphrases really as secure as random passwords?
They can be, but only with enough words. Each word from this generator draws on a list of more than 400 options and contributes roughly 8.7 bits of entropy, so a four-word passphrase is genuinely weak while a seven or eight word one is stronger than most random passwords people actually choose. The advantage is that you can remember it and type it on a TV remote or a games console. Use passphrases for the two or three passwords you must recall, and random strings for everything else.
What does entropy in bits actually mean?
Bits of entropy measure how many guesses an attacker would need. Every extra bit doubles that number, so a 60-bit password is not slightly stronger than a 59-bit one, it is twice as strong. Under 40 bits is weak, 60 to 80 bits is reasonable for low-value accounts, and 100 bits or more is beyond the reach of any offline attack that exists or is plausibly coming.
Should I turn off symbols if a website rejects them?
Only if the site forces you to, and then compensate with length. Dropping symbols shrinks the character set from 86 to 62, which costs about 0.47 bits per character. Adding three or four more characters more than makes up the difference, and the entropy readout updates live so you can see exactly when you are back where you started.
Can I use the same generated password on more than one site?
No. Reuse is the failure that causes most account takeovers, because attackers take passwords leaked from one breached service and try them everywhere else automatically. Generate a separate password for every account and store them in a password manager. Length protects you from guessing, and uniqueness protects you from everyone else's bad security.
Do I still need to change my passwords regularly?
Not on a schedule. NIST guidance now advises against forced periodic expiry, because it pushes people into predictable patterns that are easier to guess than the original password was. Change a password when you have a reason: the service reports a breach, you shared it, you typed it into something suspicious, or it is short and old.
Does this tool work offline?
Yes. Once the page has loaded, the generator needs no further network access, because all of the logic and the word list are already in your browser. You can disconnect from the internet, keep generating, and nothing will break, which is a straightforward way to satisfy yourself that nothing is being transmitted.
Generate one strong password per account, starting now
Pick a length, press generate, and save it somewhere you can find it again. The hardest part of password security is not making strong passwords, it is never reusing them, and that only works once you have a vault to keep them in.
Next steps: set up a password manager, switch on two-factor authentication for your email first, learn how to spot a phishing email, and browse the rest of our free online tools.