Generate a random password or a memorable passphrase, tuned to whatever a site's rules
require. Everything happens in your browser using a cryptographically secure random
source — nothing generated here is sent anywhere or stored.
Strength: ---- bits of entropy
16 characters
Select at least one character type.
5 words
What makes a generated password strong
True randomness
Every character or word is picked using the Web Crypto API's cryptographically secure random number generator, not JavaScript's ordinary Math.random() — which is predictable enough that it should never be used to generate anything security-sensitive.
Length over complexity
Keyspace grows exponentially with length but only linearly with character-set size. A 16-character password is dramatically harder to brute-force than a 10-character one stuffed with symbols — the slider defaults to 16 for exactly this reason.
Passphrases you can actually recall
Passphrase mode strings together random dictionary words instead of random characters. A sequence like this is genuinely harder to brute-force than it looks, and far easier for a human to type correctly and remember than an equivalent-strength jumble of symbols.
Nothing generated here ever leaves your browser
Generation happens entirely client-side. No password, passphrase, or option you select is transmitted to our servers, logged, or stored anywhere — refreshing the page leaves no trace of what was generated.
Frequently asked questions
Yes. Every character or word comes from the Web Crypto API's cryptographically secure random number generator, the same class of randomness source used for encryption keys — not the ordinary Math.random() function most simple online generators quietly use, which is fast but predictable enough that it should never be relied on for anything security-sensitive.
No. Generation happens entirely in your browser. Nothing you generate, and none of the options you choose, is ever transmitted to our servers, logged, or retained — closing or refreshing the page leaves no record of what was generated.
Random mode picks individual characters — letters, numbers, symbols — with no inherent meaning, which maximizes entropy per character but produces something hard to memorize. Passphrase mode strings together whole random dictionary words instead, which is easier to type and recall correctly while still reaching high total entropy, since each additional random word adds a large multiplier to the total keyspace.
16 characters is a reasonable default for most accounts today, and longer is better wherever a site allows it. Length matters more than cramming in symbols — a longer password using only letters and numbers generally beats a shorter one that satisfies every complexity rule a site can throw at it.
Characters that look alike in many fonts — a lowercase l, an uppercase I, and the digit 1; or the letter O and the digit 0 — cause real problems specifically when a password has to be typed by hand from a screen rather than pasted from a manager. Excluding them trades a small, practically insignificant amount of entropy for meaningfully fewer transcription errors.
Yes — adjust the length slider and character-type toggles (or the passphrase separator and word count) to match whatever the site requires before generating. If a site rejects symbols entirely, uncheck that option rather than generating a password you'll just have to edit afterward.
Complexity rules were designed around raw character-set size, but they say nothing about length or genuine randomness — "Password1!" satisfies most complexity rules and is still one of the first guesses any real attacker's wordlist will try. Our password strength checker shows the realistic crack time behind a password, complexity checkboxes aside.
Community
Get the next leak test before it's news
Tool releases and research notes, sent when there's something worth reading. Nothing else.
