Free · No sign-up · Runs entirely in your browser, nothing sent to a server
Generate strong, cryptographically random passwords entirely in your browser — nothing is transmitted or stored. Choose length, character sets and how many you need.
The Australian Cyber Security Centre recommends: use a passphrase of 4+ random words OR a random password of 14+ characters. Never reuse passwords. Use a password manager (Bitwarden, 1Password etc). Enable MFA on all accounts.
"Strong password" means one thing precisely: how many possibilities an attacker would have to work through. That is entropy, measured in bits, and it is calculated from just two numbers.
Each bit doubles the search space. A 103-bit password is not slightly harder than a 51-bit one — it is roughly four quadrillion times harder.
| Length | Entropy | Offline attack time | Rating |
|---|---|---|---|
| 8 characters | 52 bits | 30 minutes | Moderate |
| 10 characters | 65 bits | 161 days | Moderate |
| 12 characters | 78 bits | 3 thousand years | Strong |
| 14 characters | 90 bits | 26 million years | Very strong |
| 16 characters | 103 bits | 205 billion years | Very strong |
| 20 characters | 129 bits | 12,289,083 trillion years | Very strong |
| 24 characters | 155 bits | 736,970,610,145,576 trillion years | Very strong |
Adding character types expands the alphabet. Adding length multiplies exponentially. Length wins, and it is not close.
| Character sets used | Alphabet | 16-char entropy | Offline attack time |
|---|---|---|---|
| Lowercase only | 26 | 75 bits | 691 years |
| Upper + lower | 52 | 91 bits | 45 million years |
| + digits | 62 | 95 bits | 755 million years |
| All four sets | 88 | 103 bits | 205 billion years |
Going from lowercase-only to all four sets adds 28 bits. Going from 16 to 24 characters of lowercase alone adds 38 bits. Eight more characters beat every symbol on your keyboard.
Three things distinguish a sound generator from a superficial one.
| Property | What this generator does |
|---|---|
| Random source | Uses crypto.getRandomValues() — the browser's cryptographic generator. Not Math.random(), which is predictable and unsuitable for secrets |
| Unbiased selection | Rejection sampling, so every character is exactly equally likely. A plain modulo would very slightly favour some characters |
| Guaranteed composition | At least one character from every set you tick, then the whole password is shuffled |
| Nothing transmitted | Runs entirely in your browser. No server sees the password |
Official advice changed substantially, and most websites have not caught up. The US National Institute of Standards and Technology revised its digital identity guidelines to reverse several long-standing rules.
| Old rule | Current guidance | Why it changed |
|---|---|---|
| Change passwords every 90 days | Do not force expiry without evidence of compromise | Forced rotation produces predictable variations — Summer2025, Summer2026 |
| Require upper, lower, number, symbol | Drop composition rules | They push people toward predictable patterns without adding real entropy |
| Use password hints and security questions | Avoid both | Mother's maiden name and first pet are frequently public |
| Short passwords are fine with complexity | Length is the priority; support long passwords | Length is what actually resists brute force |
| — | Check against known breached passwords | A password in a breach corpus is cracked instantly regardless of how complex it looks |
The Australian Cyber Security Centre gives complementary advice for people rather than system designers: use a passphrase of several unrelated random words, make it long, make it unique to each account, and turn on multi-factor authentication wherever it is offered.
A passphrase of genuinely random words is the alternative worth knowing about, because it is memorable in a way a random string never will be.
| Random words | Entropy | Offline attack time |
|---|---|---|
| 3 words | 39 bits | Effectively instant |
| 4 words | 52 bits | About 30 minutes |
| 5 words | 65 bits | About 165 days |
| 6 words | 78 bits | About 4,000 years |
Based on words drawn randomly from a 7,776-word list. Words you choose yourself carry far less entropy than words chosen by dice or software.
This is the part people underweight. A 30-character password is worthless the moment it is reused somewhere that gets breached.
Credential stuffing is the dominant attack: take usernames and passwords from one breach and try them automatically across hundreds of other sites. It does not care how strong your password is. It only cares that you used it twice.
| Scenario | Outcome |
|---|---|
| Strong password, reused across 20 sites | One breach compromises all 20 |
| Moderate but unique password per site | One breach compromises one account |
| Unique strong password plus MFA | Breach alone is not enough to get in |
Nobody can remember thirty unique random passwords. Any advice that assumes you can will be quietly ignored, and quiet non-compliance is how reuse happens. A password manager makes unique passwords practical.
MFA is the single highest-value security step after unique passwords, because it breaks the link between a stolen password and a compromised account.
| Method | Strength | Notes |
|---|---|---|
| Passkeys / security key | Strongest | Cryptographically bound to the real site, so phishing does not work |
| Authenticator app | Strong | Six-digit codes generated on your device. Widely supported and free |
| Push approval | Good | Convenient, but beware approval fatigue — never approve a prompt you did not trigger |
| SMS codes | Weakest | Vulnerable to SIM swapping and interception — but far better than nothing |
Enable it on email first. Your email address is the reset path for nearly every other account you hold, which makes it the highest-value target you own.
| Account | Suggested length | Why |
|---|---|---|
| 20+ characters | Controls password resets for everything else. Protect it first | |
| Password manager | Long passphrase | Must be memorable and very strong. Never reuse it anywhere |
| Banking and government | 20+ characters | Direct financial and identity exposure |
| Work accounts | 16–20 characters | Compromise can extend well beyond you |
| Social media | 16+ characters | Identity and reputation, and often a reset path |
| Shopping and forums | 16 characters | Lower stakes, but must still be unique |
Everything above, condensed. Work down the list — the first three matter far more than the rest.
| Do this | Why it matters | |
|---|---|---|
| ✔ | Use a unique password for every account | The highest-impact habit. One breach then compromises one account, not twenty |
| ✔ | Store them in a password manager | The only realistic way to keep dozens of unique passwords without writing them somewhere worse |
| ✔ | Turn on multi-factor authentication | Protects you when a password leaks through no fault of yours. Start with email |
| ✔ | Use at least 16 characters | About 103 bits — beyond brute force. Use 20+ for email, banking and your master password |
| ✔ | Let software choose the characters | Human-chosen passwords have a fraction of the entropy their length suggests |
| ✔ | Keep personal information out | Birthdays, pet names and teams are tried first, and much of it is public |
| ✔ | Never share a password | Legitimate services never ask. Use proper sharing features where a manager offers them |
| ✔ | Change it when a service reports a breach | Not on a schedule — on evidence. Rotation without cause produces predictable variations |
| ✔ | Save it before you use it | A generated password you cannot retrieve locks you out of your own account |
Is this password generator safe to use?
It runs entirely in your browser using crypto.getRandomValues(), the cryptographic random source browsers provide for encryption keys. Nothing is sent to a server, logged or stored — you can disconnect from the internet and it still works. That said, the safest password is one you generate in your own password manager, since it is stored securely the moment it is created.
How long should a password be?
Sixteen characters is a sound default, giving about 103 bits of entropy with all four character sets. Use 20 or more for email, banking and your password-manager master password. Below 12 characters the numbers deteriorate quickly — eight characters is around 52 bits, which is under an hour against a fast offline attack.
What makes a password strong?
Two things: entropy, and being unique to one account. Entropy comes from length multiplied by the logarithm of the alphabet size, and length contributes far more than adding symbols. Uniqueness matters just as much, because a strong password reused anywhere fails as soon as any one of those sites is breached.
Can hackers crack a generated password?
Not by brute force at reasonable lengths. A 16-character random password from a full character set has around 103 bits of entropy, which is roughly 205 billion years even against a trillion guesses per second. Realistically, passwords are lost through database breaches, phishing and reuse — not through guessing. That is why unique passwords and MFA matter more than extra length beyond about 20 characters.
Should I use symbols in passwords?
Yes if the site allows them, but they matter less than most people think. Moving from lowercase-only to all four sets adds about 28 bits at 16 characters, while adding eight more characters adds 38. Use symbols, but never trade length to get them.
Should every account have a different password?
Yes, and this matters more than password strength. Credential stuffing takes credentials from one breach and tries them automatically across hundreds of other sites — it does not care how strong your password is, only that you used it twice. Variations such as adding the site name to a common base do not count as unique.
Should I use a password manager?
For most people, yes. Nobody can remember thirty unique random passwords, and advice that assumes otherwise leads to reuse. A manager also resists phishing by refusing to autofill on lookalike domains. Protect it with a long passphrase and multi-factor authentication, and make sure you understand the account recovery process before you need it.
How often should I change my password?
Current NIST guidance says not to force periodic changes without evidence of compromise. Forced rotation pushes people toward predictable variations, which is worse than a strong password left in place. Change a password immediately if a service reports a breach, if it appears in a breach-checking service, or if you have any reason to think it is exposed.
What is a passphrase and is it better?
A passphrase is several genuinely random words strung together. Six random words from a 7,776-word list gives about 78 bits — comparable to a 12-character random string but far easier to remember. The catch is that the words must be chosen randomly; four words you thought of yourself carry much less entropy. Use passphrases where you must type from memory, and generated strings everywhere else.
Why does the strength rating use bits?
Because bits of entropy are the only measure that reflects actual difficulty. Ratings based on which character types you ticked can be badly misleading — a long lowercase-only password can be stronger than a short one containing every symbol. Bits are calculated from length and alphabet size and are directly comparable across any two passwords.
What is multi-factor authentication?
MFA requires a second proof of identity beyond your password — a code from an authenticator app, a security key, or a passkey. It means a stolen password alone is not enough to access your account. Passkeys and hardware keys are strongest because they are cryptographically bound to the real site and cannot be phished; SMS is the weakest but still far better than nothing.
Can I save the passwords generated here?
Not on this page — nothing is stored, which is deliberate. Copy the password straight into your password manager or the account you are creating. If you lose it before saving it, generate another; there is no way to recover one from this page because it was never recorded anywhere.
Password security comes down to three things: make them long, make them genuinely random, and never use the same one twice. The generator above handles the first two. The third needs a password manager, because it is the only realistic way to keep dozens of unique passwords without writing them somewhere worse.
For other tools in this section, the IP subnet calculator and bandwidth calculator cover the networking side.
Then turn on multi-factor authentication, starting with your email — because that account is the reset path for everything else you own.