Password generator
Create strong, random passwords and passphrases in your browser, from a secure source, with a live strength meter. Nothing is uploaded.
Files are processed in your browser and never uploaded.
How to use Password generator
Set the options
Choose Length 20, How many 1, Uppercase A-Z, Lowercase a-z, Numbers 0-9 and Symbols. Nothing is hidden until you press a button.
Press Generate, Don →
The result is produced on your own device, using your browser's own random and crypto functions where randomness is involved.
Keep the result
Copy copies it.
What this tool does
Cryptographically secure, using the Web Crypto random source
Every character comes from the browser's Web Crypto random source, which is the same generator used for keys rather than Math.random.
Length, character types, custom and excluded symbols
Set the length and which sets are used, from uppercase, lowercase, digits and symbols, with your own symbol list if a site is fussy.
Exclude look-alikes, no repeats, no sequences, require all types
Exclude look-alikes, no repeated characters, no sequences like abc or 123, and require at least one of each type, for the rules real sites impose.
Passphrase mode with separators, capitals, numbers and symbols
Passphrase mode builds a memorable phrase from words, with your choice of separator, capitalisation, and a number or symbol added.
Strength meter with entropy and crack time, plus bulk generation, nothing uploaded
The meter shows entropy in bits and an estimated crack time, and you can generate many at once and copy them all.
Frequently asked questions
Are the passwords sent anywhere?
No. Every password is created on your device in your browser using the secure Web Crypto random generator. Nothing is sent, stored or logged, and it keeps working even offline once the page has loaded.
Is the randomness actually secure?
Yes. It uses crypto.getRandomValues, your operating system's cryptographic random source, with rejection sampling so every character is equally likely. It does not use the weak Math.random that some generators rely on.
How long should my password be?
Aim for at least 16 characters with several character types for everyday accounts, and 20 or more for important ones. The meter shows the entropy in bits, where 60 plus is strong and 80 plus is very strong.
What is passphrase mode for?
A passphrase is several random words, which is far easier to remember and type than a random string while still being strong, which makes it ideal for a master password. Add a number or symbol if a site insists on them.
What do all the options do?
You can set the length, choose which character types to include, exclude look-alikes such as 0 and O, require at least one of each type, avoid repeats and sequences, start with a letter, set your own symbol list or exclude specific characters, and generate several at once.
Last updated: