Password Generator

How to use

1. Open this page on any device — no signup needed.
2. Fill in the fields above.
3. Get your result instantly — nothing is uploaded.

About this tool

Strong passwords should be long (14+ characters) and mix uppercase, lowercase, digits and symbols. This generator uses your browser's cryptographic random number generator (crypto.getRandomValues), which is far stronger than Math.random(). Generate, check the entropy estimate, and copy — the password never leaves your device.

FAQ

Rate this tool

Your rating stays in this browser (local storage) — nothing is sent to any server.

How to Build a Password From Words (Passphrase Method)

A word-based password — a passphrase — trades symbol soup for length, and length is what makes passwords expensive to crack. The method: pick 4–6 unrelated words, join them with hyphens or spaces, and optionally capitalise one word or append two digits. "Copper-Harbor-Mango-Train-42" is far harder to brute-force than "C0pp3r!" yet trivially easy to type on a phone. Entropy grows by roughly 10–13 bits per random word (depending on dictionary size), so a 5-word passphrase from a 7,000-word list carries about 60+ bits — comfortably strong for personal accounts.

Password Length vs Crack Time (2026 Reality)

Offline cracking against stolen hashes uses GPU rigs that try tens of billions of guesses per second on fast hashes, and dramatically fewer against properly salted, memory-hard hashes. The table below shows order-of-magnitude estimates for a well-funded attacker against a fast hash — treat them as relative comparisons, not guarantees. The lesson is stable either way: every extra character multiplies the work, and 16+ characters pushes the timeline beyond any practical attack.

Use the generator above for 16–20 character random strings when a manager remembers them for you, and word-based passphrases when you must type them from memory.

Where a Free Generator Fits Your Setup

A generator is step one; storage is step two. Free tools like this one create the password locally in your browser — nothing is transmitted or stored — which makes them safe for on-the-spot account creation. Pair them with a password manager (free tiers of the major managers all support random 20+ character strings), enable two-factor authentication on email and banking first, and never reuse a generated password across two sites. For shared accounts, share via the manager's built-in sharing rather than chat apps.

• Generate unique passwords for every account — reuse is how one breach becomes ten.
• Change immediately if a service reports a breach; check haveibeenpwned-style databases.
• For Wi-Fi or router passwords, passphrases win: guests can actually type them.
• Avoid personal-data patterns (birthdays, pet names) — they are the first guesses attackers script.