Password Generator
Generate strong, random passwords with a strength meter — secure, free, in your browser.
Words are drawn from the 7,776-word EFF list, so each one adds 12.9 bits. Easier to type and remember than a random string of the same strength.
A PIN is only as safe as the device that rate-limits it. Do not reuse it as a password.
Strong Password Generator - Create Secure Random Passwords
A password you can invent yourself is a password an attacker can guess. Human-chosen passwords cluster around names, dates, keyboard patterns and word substitutions that cracking tools try first. This free random password generator removes that bias: it builds each character from your browser's cryptographic random number source, so the result has no pattern to exploit.
Set the length, decide which character sets to include, and generate one password or ten at a time. The Mode menu switches between a random Password, a memorable Passphrase made of real words, and a numeric PIN. A strength indicator and the entropy in bits update as you change the options, and nothing you create is transmitted, stored or logged anywhere.
What actually makes a password strong
Strength is measured in entropy - the number of guesses an attacker would need. Entropy grows with the size of the character set, but it grows much faster with length. Adding one more character multiplies the search space; adding one more symbol type only widens it slightly. That is why a 16-character password of mixed letters and digits beats an 8-character password stuffed with punctuation, and why every serious security guideline now leads with length.
Three modes: password, passphrase and PIN
| Mode | What it produces | Entropy with the default settings |
|---|---|---|
| Password | A random string of 4 to 128 characters from the sets you tick | 16 characters of letters and digits: about 95 bits |
| Passphrase | 3 to 12 random words joined by a separator | 5 words: about 65 bits |
| PIN | 3 to 12 random digits | 6 digits: about 20 bits |
Passphrase draws its words from the EFF Large Wordlist, 7,776 short words picked to be easy to type and tell apart, so each word adds 12.9 bits. Choose the Separator (-, ., _ or a space) and turn on Capitalise each word or Add two digits when a form insists on a capital letter or a number. PIN produces 3 to 12 digits for a phone lock or a door code and nothing else. Whichever mode you use, the line under the result gives the entropy in bits: one word from the list is worth 12.9 bits, and a 20-character password drawn from the full 88-character pool is about 129 bits. Word list: EFF Large Wordlist, CC BY 3.0 US.
How long should a password be?
| Where you use it | Minimum length | Notes |
|---|---|---|
| Ordinary website account | 16 characters | Long enough to resist offline cracking if the site is breached |
| Email, banking, cloud storage | 20 characters | These accounts can reset every other password you own |
| Database, server or root credentials | 24 characters or more | Machine-typed anyway, so length costs you nothing |
| API keys and service secrets | 32 characters or more | Treat as a token; rotate on a schedule |
| Wi-Fi network key | 20 characters | Captured handshakes can be attacked offline forever |
How to generate a password here
- Pick the Mode: Password, Passphrase or PIN. The options below it change with your choice.
- For a password, drag the length slider - anywhere from 4 to 128 characters, with sixteen as a sensible default. A passphrase uses Words instead (3 to 12), a PIN uses Digits (3 to 12).
- Tick the character sets you need: uppercase, lowercase, numbers and symbols.
- Leave At least one of each switched on so every set you ticked really turns up in the result.
- Enable Exclude ambiguous if the password will be read aloud or typed manually.
- Click Generate for one password, or Generate 10 to pick from a batch.
- Read the entropy in bits under the result, then copy the password and paste it straight into your password manager.
When a site rejects a generated password
Plenty of sign-up forms demand at least one digit or one symbol, and a string of purely random characters will not always contain one. At least one of each exists for that case and is on by default: it reserves one character from every set you ticked, as long as the length leaves room for them all, so the first password you generate already satisfies the rule instead of sending you back for another try. If the form caps the length instead, shorten the password and tick Symbols to win back some entropy; if it refuses symbols altogether, untick them and add four characters of length.
Why exclude ambiguous characters?
In many fonts the digit 1, lowercase l and uppercase I look nearly identical, as do 0 and O. That is harmless when a password manager fills the field, but painful when someone has to read a Wi-Fi key off a card or type a temporary credential from a support ticket. Switching the option on trades a tiny amount of entropy for a large reduction in failed logins - just add a couple of characters of length to compensate.
Where to keep the password
A generated password is only useful if you never have to remember it. Store it in a password manager, use a unique password for every single account, and turn on two-factor authentication wherever it is offered. Reuse is the real danger: one breached site turns into a dozen compromised accounts the moment attackers replay the same credentials elsewhere.
Mistakes that weaken good passwords
- Reusing one strong password across several services instead of generating a new one each time.
- Predictable substitutions such as
P@ssw0rd- cracking dictionaries have included those for decades. - Building passwords from birthdays, pet names, team names or anything visible on your public profiles.
- Sending credentials over chat or email, where they stay searchable long after the task is finished.
- Adding
2024or!to an old password when a rotation policy forces a change. - Storing passwords in a spreadsheet, a notes app or the browser of a shared computer.
What about passphrases?
Four or five random, unrelated words are easy to memorise and genuinely strong - a good choice for the master password of your password manager or a disk encryption key, because those are the two you actually have to type from memory. Set Mode to Passphrase and this page builds one for you rather than a random string. For everything else, a generated random string is shorter, faster to paste and never needs recalling.
Generated privately in your browser
Every password comes from crypto.getRandomValues, the browser's cryptographically secure random source, and never leaves the page. There is no server round trip, no logging and no history, so a password you generate here exists only where you paste it. Passphrase mode downloads the word list once, as an ordinary static file, but nothing you generate ever travels the other way.
Generate a random password on the command line
For a server, a script or a one-off secret you may not want to open a browser at all. openssl rand -base64 24 prints a 32-character random string on Linux and macOS; in PowerShell, -join ((33..126) | Get-Random -Count 20 | ForEach-Object { [char]$_ }) gives 20 printable characters. Both draw on the operating system's secure random source, exactly as this page does. A password manager remains the better home for anything you must keep.
Related tools
Need other kinds of unique values? Create identifiers with the UUID generator, compute fingerprints with the hash generator, inspect an access token with the JWT decoder, and share a Wi-Fi login without dictating it using the QR code generator.