Secure Password & Passphrase Generator
This free password generator creates strong random passwords using your browser's cryptographically secure random number generator (the Web Crypto API), never the predictable Math.random(). Configure length (8–64 characters), character classes, and readability options, or switch to the Passphrase tab for easy-to-remember word-based secrets like correct-horse-battery-staple.
Passwords are generated entirely on your device and never transmitted, stored, or logged — this page runs no server-side code at all. Generate in bulk (up to 100 at once) when provisioning test accounts.
How to use Password Generator
- Choose the Password or Passphrase tab.
- For passwords: set the length with the slider, then toggle uppercase letters, numbers, and symbols. Optionally exclude look-alike characters (il1Lo0O) or ambiguous symbols, or supply a custom character set.
- For passphrases: pick the number of words (3–10) and a separator character.
- Press Generate, review the strength meter, and copy the result.
What makes a password strong?
Strength is measured in entropy — the number of equally likely possibilities an attacker must try. Entropy grows with length and character-set size: each additional random character from a 94-symbol set adds about 6.5 bits. A 16-character mixed password (~105 bits) is far beyond brute force with current hardware. Length beats cleverness: a longer password from fewer classes usually outranks a short one full of substitutions like P@ssw0rd, which cracking tools try first.
Passphrases achieve strength through word count instead: four or more words chosen randomly from a large list are both strong and genuinely memorable, which makes them ideal for master passwords you must type.
Password best practices
- Use a unique password for every account, so one breach never cascades.
- Store them in a password manager instead of reusing memorable ones.
- Prefer 16+ characters, or a 4–6 word passphrase for anything you type by hand.
- Enable two-factor authentication where available — it protects you even if a password leaks.
- Never share passwords over email or chat.
Related terminology
- Entropy
- The measure of a password's unpredictability in bits; every extra bit doubles the work of a brute-force attack.
- CSPRNG
- Cryptographically Secure Pseudo-Random Number Generator — randomness suitable for secrets, provided in browsers by crypto.getRandomValues().
- Passphrase
- A password built from randomly chosen words — long, high-entropy, and much easier to remember and type than symbol soup.
- Brute-force attack
- Systematically trying candidate passwords until one works; defeated by length and randomness.
Frequently asked questions
- Is this password generator safe to use?
- Yes. Generation runs entirely in your browser using the Web Crypto API's secure random source; nothing is sent to a server, stored, or logged. You can verify with your browser's network tab — no requests are made when generating.
- How long should my password be?
- 16 characters or more with mixed character classes for accounts managed by a password manager; a 4–6 word passphrase for master passwords you type manually. Anything under 12 characters is increasingly exposed to modern cracking hardware.
- What does "Exclude Similar" do?
- It removes characters that are easily confused when read or typed — i, l, 1, L, o, 0, O — which is helpful for passwords that must be dictated or entered on a TV or console keyboard.
- Are passwords or passphrases better?
- Both are strong when generated randomly. Random character passwords pack more entropy per character; passphrases are easier for humans. Use passphrases where you must remember or type the secret, and long random passwords everywhere a manager fills them in.