Password Generator
Create a strong random password, or build a memorable password from random words — switch to the Passphrase tab to generate one from words instead of symbols. Everything happens on your device: no password is ever transmitted or logged.
How strong passwords are measured here
The strength meter estimates entropy (bits of randomness) from the character set size and length you choose, not just length alone. A 12-character password using only lowercase letters is far weaker than a 12-character password mixing upper/lowercase, numbers, and symbols — the meter reflects that difference.
Passphrases (a sequence of random words) are often easier to remember than a string of random characters while still being hard to guess, provided you use enough words — we recommend at least 4.
The same browser random-number generator (the Web Crypto API) powers the UUID generator, if what you need is a unique ID rather than a secret, and the hash generator computes SHA-256 checksums locally.
Making a password from words
If you want a password generator that builds a password from words rather than
a jumble of symbols, that is exactly what the Passphrase tab
does. It picks several unrelated words at random — timber-oasis-quill-nimbus,
say — and optionally capitalises them, joins them with a separator, and appends
a number. The result is a password made from words that is genuinely easy to
recall and to type, yet resists guessing because the words are chosen randomly,
not from a phrase you already know.
The strength comes from how many words you use and the fact that each is drawn randomly, not from any single word being obscure. Four or five random words already put a word-based password well past the length where brute-force guessing is practical — which is why a memorable passphrase can be as strong as a much shorter random string. Avoid building one from song lyrics, a famous quote, or words tied to you personally; the randomness is what does the work.
Frequently asked questions
How long should my password be?
For anything important — email, banking, your password manager's master password — aim for at least 16 characters with a mixed character set, or a 5+ word passphrase. Shorter passwords can still be fine for low-value, rarely-reused accounts, but length is the single biggest lever for resisting brute-force guessing.
Password or passphrase — which is more secure?
Both can be equally secure if they're long enough — what matters is total entropy (bits of randomness), not which style you pick. A passphrase of 5+ random words is often easier to remember and type correctly (especially on mobile) than an equivalent-strength string of random characters, which is why we recommend at least 4-5 words if you go that route.
Is it actually safe to generate a password in my browser?
Yes. This tool uses the Web Crypto API's crypto.getRandomValues(), which is a cryptographically secure random number generator built into your browser — the same class of randomness used for things like TLS. Nothing you generate here is transmitted anywhere or logged; it exists only in your browser tab.
What are "ambiguous characters" and why would I exclude them?
Characters like 0/O, 1/l/I, and similar look-alikes can be hard to tell apart in some fonts — useful to avoid if you'll be reading the password aloud, typing it from a printed slip, or entering it on a device with a small or unusual font. Excluding a handful of characters barely reduces overall entropy, so it's on by default; uncheck it if you want the absolute maximum character space.
How much entropy (bits) do I actually need?
As a rough guide: under 36 bits is weak (crackable quickly with modern hardware), 36-59 bits is moderate (fine for low-stakes accounts), 60-79 bits is strong, and 80+ bits is very strong — appropriate for anything sensitive. The strength meter above updates live as you change length and character-set options.
How do I generate a password from words?
Switch to the Passphrase tab and click Generate. It builds a password from several random words joined by a separator, such as timber-oasis-quill-nimbus, and can capitalise them and add a number. A password made from random words is easy to remember and type but still hard to guess — pick at least 4 or 5 words, and let the tool choose them randomly rather than using a phrase you already know.
Can I reuse a generated password across multiple accounts?
No — always generate a unique password per account. If one site has a data breach, reused passwords let attackers try the same credentials everywhere else (called credential stuffing). Use a password manager to store unique generated passwords without needing to remember each one.