Browser-only · Web Crypto API

Password Generator

Cryptographically strong passwords, memorable passphrases, and PINs. Generated locally with crypto.getRandomValues — nothing transmitted, nothing logged.

Your password

Very Weak0.0 bits · crack ≈ instant

Options

Recent (this session)

Generated passwords from this tab will appear here. History never leaves your browser memory.

Tip: a 16-character mixed password or 5-word passphrase is enough for most accounts. Use a password manager so you never have to remember more than one.

How to pick a good password

Length beats complexity

A 20-character lowercase password is stronger than an 8-character one stuffed with symbols. Aim for ≥ 60 bits of entropy for everyday accounts, ≥ 80 bits for anything financial or recovery.

Random > clever

Substituting 4 for a doesn't fool modern crackers. They know every trick. The only defense is genuine randomness from a CSPRNG — which is what this tool uses.

Never reuse

One leaked database becomes a key to every account sharing that password. Generate a fresh one for every site and store them in a password manager (1Password, Bitwarden, Apple Passwords).

Memorable passphrases work

For the few passwords you must type by hand (vault master, full-disk encryption), a 5–7 word passphrase is both strong and rememberable. The four-words-XKCD pattern is real.

ALL TOOLS · THE CATALOG

113 single-purpose utilities · runs local

Browse all →

IMAGE

Image Tools

MEDIA

Video & Audio

DEV

Developer Tools

DOCS

Documents & Utility

CALC

Calculators

AI Tools

MONEY

Finance

SOCIAL

Social Mockups

All tools process files entirely in your browser · Your data never leaves your device

Entropy by mode and length — what actually resists cracking

Password strength is measured in bits of entropy, and entropy comes from the size of the character set raised to the length, not from looking complicated. The numbers below assume an offline attack against a fast hash at roughly 10 billion guesses per second, which is what a modern GPU rig does.

Mode / length	Pool size	Entropy	Offline crack time
PIN · 4 digits	10	~13 bits	Instant
PIN · 6 digits	10	~20 bits	Instant
Random · 8 chars, letters + digits	62	~48 bits	Under an hour
Random · 12 chars, full set	94	~79 bits	Tens of thousands of years
Random · 16 chars, full set	94	~105 bits	Beyond any practical attack
Memorable · 4 words	~7,776 per word	~52 bits	A few days
Memorable · 6 words	~7,776 per word	~78 bits	Comparable to a 12-char random password

A passphrase only earns its entropy if the words are drawn randomly from a large list. Words you chose yourself carry far less than the table suggests, because human word choice is heavily predictable.

Excluding ambiguous characters (0/O, 1/l/I) shrinks the pool slightly and costs a bit or two of entropy — worth it when the password will be read aloud or typed off a screen, not worth it for one you paste from a manager.

Length beats character variety: a 16-character lowercase-only password has more entropy than an 8-character one using every symbol on the keyboard.

Every candidate here is generated with your browser’s cryptographic random source, not Math.random, and nothing is transmitted — the page has no network call at all after it loads.

How to generate a strong random password

Pick mode. Choose Random (e.g. xK!9pQzL$2vM) for max strength, or Passphrase (e.g. correct-horse-battery-staple) for memorability.

Set length and charset. Random: 16–128 chars; pick uppercase, lowercase, digits, symbols, exclude ambiguous (0/O, l/1).

Generate. Click Generate. New passwords appear instantly, sourced from window.crypto.getRandomValues (cryptographically secure).

Copy and use. One-click copy. Paste into your password manager — never reuse passwords across sites.

Frequently Asked Questions

Are passwords stored or sent anywhere?

No. Generation runs in your browser using the Web Crypto API. Passwords are never logged, transmitted, or stored — even by the page itself.

Is it cryptographically secure?

Yes. We use window.crypto.getRandomValues, the same source browsers use for HTTPS keys.

Should I use random or passphrase?

For master passwords / sites without a manager, passphrase (4+ words) is easier to remember and equally strong. For service passwords stored in a manager, random is shorter.

How long should my password be?

At least 16 characters for random, or 4+ words for passphrase. Both yield 60+ bits of entropy (effectively unguessable).

What is EFF wordlist?

EFF Diceware: a curated list of 7,776 short, memorable English words designed for secure passphrases. Each word adds ~12.9 bits of entropy.

Can I exclude ambiguous characters?

Yes. Toggle "exclude ambiguous" to skip 0/O, l/1, I — useful for passwords you must type by hand.