Skip to content

Strong Password Generator

Generate cryptographically random passwords with an entropy and crack-time meter.

Private Instant No sign-up No daily limit

Free to use. No account, no daily limit, and no watermark on the result.

 1 · Password settings

Web Crypto API

Current length: 20 characters

Character sets

Current length: 6 words

Every passphrase is picked from a built-in list of 256 common English words using the browser’s cryptographic random number generator — no server, no tracking.

 2 · Your password

Password
Entropy
0 bits
Strength
—
Time to crack
—
Possible keys
—

Generate a password to see its strength.

Passwords are produced with crypto.getRandomValues() and unbiased rejection sampling — never with Math.random(). Crack times assume an offline attacker guessing at 10 billion attempts per second on a modern GPU rig.

 3 · Bulk list

10 at a time
Press “Generate 10 passwords” to build a batch you can copy into a spreadsheet or password manager.

How to generate a strong password

1

Choose your style

Pick a random password with your own length and character rules, or switch to the passphrase tab for something memorable.

2

Generate

Hit Regenerate as often as you like — every new password is drawn from the browser’s cryptographic random number generator.

3

Check the strength

The meter shows the entropy in bits, the estimated time to crack the password offline and a plain-language rating.

4

Copy and store safely

Copy the password into your password manager and never reuse it on another site.

Password generator — frequently asked questions

No. Generation happens locally in your browser using the Web Crypto API (crypto.getRandomValues). Nothing is uploaded, logged or stored, and closing the tab destroys the result.

Length beats complexity. A 16-character password mixing letters, digits and symbols gives about 100 bits of entropy and is effectively uncrackable offline, while an 8-character password with one capital letter and a digit is easy to brute force. For a passphrase, four to six random words are ideal.

The estimate assumes an offline attacker with a fast GPU rig trying 10 billion guesses every second against a hashed password. Real-world attacks are usually slower because of server rate limits, but this is the standard worst-case reference used by password managers.

It depends on where you type the password. Excluding characters such as 0, O, 1, l and I removes about 10 characters from a typical alphabet, so use the option when you may read the password aloud or copy it from a printout. It makes no real difference to how secure the password is.

Related Utilities & Media