Password Generator

A new password is already waiting in the box above. Change any setting and it is replaced at once; press the round arrow for another one, the eye to hide it from people looking over your shoulder, and Copy to put it on your clipboard. There is no Generate button to hunt for and nothing to sign up for.

This password generator makes four kinds of secret: random characters, a passphrase of real words, an easy-to-say password built from syllables, and a numeric PIN. Under the result you see a strength bar, the strength in bits and a rough guess of how long a fast attacker would need to find it.

Everything happens on your own device. The passwords come from your browser's cryptographic random number source, they are never sent to a server, never written to a log and never saved. Only your settings, such as length and character choices, are remembered in this browser so the next visit starts the way you like it.

A password is strong when an attacker cannot guess it in any realistic amount of time. Attackers do not type guesses into a login page one by one. When a website is breached, they copy the stored password hashes and test billions of guesses per second on their own hardware, starting with leaked passwords, dictionary words, names, dates and the usual tricks like a capital at the start and a ! at the end.

Against that kind of attack only two things count: how many possible passwords there are, and whether yours was picked at random from all of them. Length matters most, because every extra character multiplies the number of possibilities. Adding character types helps too, but less than people think. A random 16-character password of letters and numbers is far stronger than an 8-character one stuffed with symbols.

Every setting on this page is open to everyone: the full length range of 4 to 128 characters, passphrases, PINs, bulk lists of up to 500 passwords, TXT and CSV downloads, your own list of special characters and the strength checker. You do not need an account, an email address or a trial. If you were looking for a strong password generator free of sign-ups and limits, that is what this page is meant to be.

There are no adverts inside the tool, no watermark and no daily limit. Because the work runs in your browser, the page costs us almost nothing per password, so there is no reason to ration it. Make one password or a few hundred; the result is the same quality either way.

Free does not mean careless. A strong password generator is only worth using if the randomness is sound and nothing leaves your device, so both points are explained in plain words below, together with honest notes on what the strength meter can and cannot tell you.

The random part is the heart of a password tool, and it is easy to get wrong. Many simple scripts use Math.random, a fast number source meant for games and animations. It is not designed to be unpredictable, and in some cases its output can be reconstructed. This tool never uses it for passwords.

Instead, each character comes from crypto.getRandomValues, the cryptographic random generator built into every modern browser. It is seeded by your operating system from hardware events and is the same source browsers use for encryption keys. That makes every password generator random output here unpredictable, even to someone who knows exactly how the page works.

There is a second, quieter trap called modulo bias. A random number is usually picked from a large range, for example 0 to 4,294,967,295, and then squeezed into the size of the character set with a remainder. If the large range does not divide evenly, a few characters come up slightly more often than others. The difference is tiny but real. The generator here uses rejection sampling: numbers from the uneven tail are thrown away and drawn again, so every character in the set has exactly the same chance.

A passphrase is a password made of several random words, such as Dwelling-Shrimp-Unfold-Lantern7-Basin. Choose Words (passphrase) at the top of the tool and a new one appears. This password generator with words picks from the EFF Large Wordlist, a list of 7,776 common English words chosen by the Electronic Frontier Foundation to be easy to spell, easy to tell apart and free of offensive terms.

Each random word from a 7,776-word list adds about 12.9 bits of strength. Four words give about 52 bits, five about 65 and six about 78, before the extra number. That is why the slider allows 3 to 12 words: three words are only for low-value accounts, five or six are a good balance, and more are there for a master password that protects everything else.

The Style card controls how the words are joined. The separator can be a hyphen, a dot, an underscore, a space, nothing at all, or digits, which puts a random number between each pair of words and adds about 3.3 bits per gap. Capitals can be none, First letter, ALL or Random, where Random capitalises each word by a coin toss and adds one bit per word. Add a number puts one digit after a random word and Add a special character puts one of ! @ # $ % & * ? after a random word, for sites that insist on them.

A password generator words easy to remember setting is mostly about you, not the tool. The words are random, which is what makes them strong, but your brain is good at linking random words into a small story. Tulip, Ranch, Ember, Gravy, Swirl becomes a tulip growing on a ranch, glowing like an ember, dipped in gravy, stirred in a swirl. Picture it once or twice and it tends to stick.

Do not swap the words for ones you like better or reorder them into a sentence that makes sense. The moment you choose, the passphrase stops being random and the strength figure is no longer true. If a set of words really does not work for you, press the round arrow and take a fresh set instead.

Easy to say builds a password from simple syllables that alternate consonants and vowels, such as Mobitazeruko42. There are no look-alike letters to argue about and no symbols to spell out, so it is easy to read to someone over the phone, write on a whiteboard for guests or type with the arrow keys on a TV.

The price is strength per character. Syllables follow a pattern, so each character adds much less than a fully random one, and the meter shows only a rough figure for this type. Use a longer length than you would for random characters, at least 20 for anything that matters. The slider runs from 6 to 40, Start with a capital adds an uppercase first letter and End with two numbers replaces the last two characters with digits.

Choose PIN for a numeric code of 4 to 16 digits. With Avoid easy PINs ticked, the tool skips PINs that contain the same digit three times in a row and PINs that are part of a straight run up or down, such as 1234 or 987654. These are the first codes anyone tries.

A PIN is weak on paper: six digits have only a million combinations, about 20 bits. It works because phones, bank cards and many locks refuse more tries after a few wrong guesses. Use a random PIN where such a lockout exists, prefer six or more digits when the device allows it, and never use a PIN for an online account that accepts a full password.

Tick Special characters (!@#$…) and the password draws from 28 symbols: ! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . < > / ? ~ |. Together with letters and numbers that makes a pool of 90 characters, about 6.5 bits each. A password generator with special characters is the right choice for sites that demand a symbol, and the extra characters squeeze a little more strength into a short field.

Some sites accept only a few symbols, or reject one that breaks their form. Open More options and type your own list in Special characters, for example only ! @ # $. Letters, digits and spaces are removed from that box automatically, so it only ever holds symbols. Next to it you can set At least how many special characters and how many numbers each password must contain, from 0 to 20.

With At least one of each chosen kind ticked, every password contains at least one uppercase letter, one lowercase letter, one number and one special character, if those kinds are switched on. The required characters are then shuffled into random places, so the password does not always start with a capital.

Some systems still refuse symbols: older banking portals, router admin pages, a few game launchers and many internal company tools. Others accept them but break when you type one on a TV or a foreign keyboard. For those, a password generator without special characters is the practical answer.

Untick Special characters (!@#$…) and the password uses only letters and numbers, a pool of 62 characters and about 6 bits each. To keep the same strength, add length instead: two or three extra characters make up for the missing symbols. A 16-character letters-and-numbers password is around 95 bits, already far beyond what any attacker can try.

If a site accepts some punctuation but chokes on brackets and quotes, keep special characters on and tick No brackets or quotes instead. That removes { } [ ] ( ) / and the backslash, both kinds of quote mark, the backtick, the tilde, the comma, semicolon, colon, full stop and the angle brackets, the characters that most often clash with forms, scripts and command lines.

Twelve characters is a sensible floor for any account you care about. A password generator 12 characters setting with all four kinds of character gives about 78 bits; with letters and numbers only it is about 71 bits. The meter calls both Strong, and an offline attack at 10 billion guesses a second would still take thousands of years on average.

Tap 12 under the Length slider to set it in one click. Twelve is also a common maximum on older systems, so it is a good length when a site rejects anything longer. If a site allows only 8, use all four kinds of character and turn on two-factor sign-in, because 8 random characters of all kinds is only about 52 bits.

Sixteen characters is the default here, and for good reason. A password generator 16 characters result with all four kinds is about 104 bits, which the meter rates Very strong and which no known attack can search. It is also short enough to fit almost every password field, including those that stop at 16.

If you use a password manager you rarely see or type the password, so there is no real cost in going this long. Sixteen is a good everyday choice for email, shopping, social media and work accounts alike.

For the accounts that guard other accounts, such as your main email, your password manager, cloud storage and banking, go longer. A password generator 20 characters setting is about 130 bits with all kinds and about 119 bits with letters and numbers only. The quick buttons also offer 24, 32 and 64, and the slider goes up to 128 for Wi-Fi keys, encryption passphrases and service tokens.

Need passwords for a class, a batch of new staff accounts, test users or a set of devices? Open More options and set How many to any number from 1 to 500, or tap 1, 5, 10, 50 or 100. The result turns into a numbered list with a copy button on every line.

Below the list, Copy all puts every password on the clipboard one per line, TXT downloads a plain text file and CSV downloads a spreadsheet file with a password column, ready to open or import. New list replaces all of them at once. Every password in the list is made separately with the same settings and the same fair randomness.

Treat the downloaded file like the passwords themselves: hand them out, make sure people change or store them, then delete the file. If you send the file to someone, put it in a password-protected PDF with Protect PDF or share it through your password manager rather than sending it as plain text.

The bar and the line under each password show four things: a label from Very weak to Very strong, the strength in bits, the length, and roughly how long a fast computer would need to guess it. For random characters, bits are worked out exactly from the length and the size of the character pool; for passphrases from the size of the word list and the extras you chose.

The guessing time assumes an offline attack at 10 billion guesses per second, on average searching half the possibilities. That is roughly what a well-equipped attacker can do against a leaked database with fast hashing. Real attacks can be faster with more hardware and much slower when the site stores passwords with a slow hash, so please read the time as an estimate, not a promise. What it shows reliably is the difference between choices: each extra bit doubles the work.

The labels follow simple bands: under 28 bits Very weak, under 40 Weak, under 60 Fair, under 80 Strong and 80 or more Very strong. For important accounts, aim for 80 bits or more; for random characters that means at least 13 characters with all four kinds.

Under the settings is How strong is my password?, a box where you can type any password to see a rating, an estimate in bits and a guessing time. The box is a password field, so the text is hidden as you type, and nothing you type in it is sent anywhere, stored or added to the settings that are remembered.

For a password you made up, the estimate is rougher than for a generated one, because nobody can know exactly how a person chose it. The checker starts from the length and the kinds of characters, then cuts the score for patterns attackers try first: famous passwords such as qwerty, three or more repeated characters, runs such as 1234 or asdf, a year, and a single word followed by a few numbers and a symbol. If the result is under 60 bits, it suggests using a longer password from the generator.

Current guidance from security standards bodies, including the US NIST digital identity guidelines, has moved away from the old rules of forced symbols and monthly changes. The main points are short and practical.

Strong random passwords are only practical with a password manager. It stores every password in an encrypted vault, fills them in for you and syncs them between your phone and computer. You remember one strong passphrase, and it remembers the rest. Most browsers and phones now include one, and there are many independent apps.

A good routine is simple: generate a password here, paste it into the sign-up form, and save it in the manager at the same moment. Many managers also generate passwords themselves; this page is useful when you need settings the manager does not offer, a passphrase, a PIN or a list of many passwords at once.

The single most common way accounts get taken over is reuse. When one site is breached, attackers try the same email and password on hundreds of other sites, a method called credential stuffing. If your password is unique, a breach somewhere else stays somewhere else.

Two-factor authentication, also called 2FA or two-step sign-in, asks for something besides the password: a code from an authenticator app, a security key, a passkey or a prompt on your phone. Even a perfect password can be stolen by a fake login page or malware; the second factor stops most of those attacks.

Turn it on first for your main email, because anyone who controls your email can reset your other passwords. Then your password manager, banking, cloud storage and social media. Prefer an authenticator app or security key over text messages where you can, and keep the backup codes somewhere safe, for example in your password manager.

This password generator works in your browser with crypto.getRandomValues. The passwords are not sent to our server or anyone else's, not logged, not kept in browser storage and not put in the address bar. Close the tab and they are gone, unless you copied or downloaded them.

The page does remember your settings, such as type, length, character choices and the number of passwords, in this browser's local storage, so the tool opens the same way next time. You can clear that with your browser's site data settings. The word list for passphrases is a static file loaded from this site; it does not reveal which words you got.

Protecting a document rather than an account? Protect PDF adds a password to a PDF in your browser, and a long random password from this page is a good fit for it. If you have lost track of a password on your own file, Unlock PDF removes it when you know the current one.

Sharing your home Wi-Fi with guests is easier with the QR Code Generator: put your new Wi-Fi password into a code and guests scan it instead of typing it. Before you send photos or documents, Remove Metadata strips hidden details such as location and device names.