Are these passwords generated privately in my browser?

Yes, entirely. Every password and passphrase is created on your own device using crypto.getRandomValues, the browser's cryptographically secure random generator. Nothing is sent to a server, written to a log or stored anywhere. Signing in is only needed to copy a result so your work can follow you across our other tools; the generating and the strength rating never require an account, and the secret itself never leaves the page.

What makes this randomness secure?

It uses the Web Crypto API's getRandomValues, which is seeded from the operating system's entropy and designed to be unpredictable, rather than Math.random, which is not cryptographically secure and can in principle be predicted. Each character is also drawn with rejection sampling so every option is exactly equally likely, avoiding the small bias a naive approach introduces. That combination is what makes the output genuinely unguessable rather than merely random-looking.

How is the strength number calculated?

It is the true entropy of the generation process, not a guess about the finished string. For a password it is the length multiplied by the base-two logarithm of the character-pool size; for a passphrase it is the number of words multiplied by the base-two logarithm of the wordlist size. That gives the number of bits of genuine unpredictability, which is then turned into a crack-time estimate against an offline attacker at a hundred billion guesses a second. Because it is arithmetic on how the secret was made, it is exact.

Is a passphrase really as strong as a random password?

It can be, and it is far easier to remember. Strength comes from unpredictability, and a passphrase of several words chosen at random from a large list has a great deal of it: four or five random words is genuinely hard to crack, while still being something you can type or say aloud. A random character string packs more entropy per character, so it is the better choice for secrets a password manager will store. The meter shows the real entropy for both, so you can see the trade rather than guess at it.

How long should my password be?

Length is the single most important factor, because each extra character multiplies the search space. For anything a password manager stores, sixteen characters or more of mixed types is a strong baseline and longer is better, since you never have to type it. For a passphrase you will remember, four or five random words is a good target. Rather than aim for a fixed number, watch the entropy meter and choose a setting that lands solidly in the strong range for how the secret will be used.

Should I still use two-factor authentication?

Yes, always, where it is offered. A strong unique password protects an account if a site's password database is breached, but two-factor authentication protects it even if the password itself is stolen through phishing or malware, because the attacker still lacks the second factor. The two work together: strong generated passwords in a manager, plus a second factor on anything that matters. Building that layered protection into a real product is the kind of work our team does when the stakes are higher than a single login.

Free Tool

Free Password Generator, strong secrets, minted in your browser

Generate a strong random password or a memorable word passphrase, drawn from your browser's own cryptographically secure randomness so nothing is ever transmitted, logged or stored. Tune the length, the character sets and the wordlist, and watch a live strength meter that does not guess: because the tool made the secret, it knows its exact entropy in bits and shows an honest estimate of how long it would take an attacker to crack. Copy it and go.

Generating...

Length20

664

Generated in your browser with the Web Crypto API. Nothing is transmitted, logged or stored.

A password generator has one job and it is a job of trust. The whole value of a generated password is that it is unpredictable, and the whole risk is that it might not stay secret. That makes most online generators quietly self-defeating: if a website generates your password on its server, then that server, and its logs, and anyone who can read them, has seen your password before you have even used it. Even generators that run in the browser often lean on Math.random, which is not cryptographically secure and produces sequences that can, in principle, be predicted, so the password looks random without actually being random in the way that matters. And then there is the strength meter. Most of them are theatre: they look at the finished string and make a rough guess from its length and variety, a guess that is easily fooled in both directions, calling a genuinely strong password weak or a predictable one strong. This tool is built the other way around on all three counts. Every character comes from the browser's cryptographically secure generator, so it is truly unpredictable. Nothing leaves the page, so no server ever sees the secret. And because the tool generated the password, it does not guess the strength, it calculates the exact entropy of the process that made it, which is the only honest number there is.

Cryptographically secure, and never transmitted

There are two ways to generate randomness in a browser, and the difference is the whole point of a password tool. Math.random is fast and fine for shuffling a playlist, but it is not cryptographically secure: its output comes from a predictable internal state, so a determined attacker who sees enough of it can work out what comes next. crypto.getRandomValues, the Web Crypto generator, is designed for exactly this purpose, seeded from the operating system's own entropy and built to be unpredictable. This tool uses only the latter, and it draws each character with rejection sampling so that no character is even slightly more likely than another, avoiding the subtle bias that a naive modulo introduces. Just as important as how the password is made is where: all of it happens on your machine, inside the page. The generated secret is never sent anywhere, never written to a log, never stored. A password you can see on a page we served is a password we could in principle have logged; doing the work in your browser is the only version of this that deserves your trust, and it is the version you get here.

A strength meter that measures, instead of guessing

Almost every strength meter you have seen works backwards: it takes a finished password and tries to guess how strong it is by scoring its length and character variety. That is guesswork, and it is wrong often. It will call correct-horse-battery-staple weak because it has no digits, and call P@ssw0rd1 strong because it ticks the boxes, when the truth is the reverse. This tool measures strength at the source. Because it generated the password, it knows precisely how it was made: how large the pool of possible characters was and how many were drawn, or for a passphrase, how many words came from a list of a known size. From that it computes the real entropy, the number of bits of genuine unpredictability, which is the actual measure security professionals use. Then it translates that into something concrete: an estimate of how long a well-resourced offline attacker, running a hundred billion guesses a second, would need to crack it. That number is deliberately a little conservative, and it is honest, because it is arithmetic on how the secret was generated, not a guess about a string.

Random passwords and memorable passphrases

The strongest password is one you never have to remember, stored in a password manager, and for that a long random string of mixed characters is ideal: maximum entropy per character, and you only ever copy and paste it. But not every secret lives in a manager. Sometimes you need one you can actually type or say aloud, the master password for the vault itself, a device login, a Wi-Fi key you read to a guest. For those, a passphrase is the better tool: a handful of random common words is far easier for a human to remember than a scramble of symbols, and because the words are chosen randomly from a large list, a phrase of four or five of them is genuinely strong, not the illusion of strength that a short complex password gives. This tool does both, and shows the honest entropy for each so the trade is explicit. Switch to passphrase mode, choose how many words, a separator and whether to capitalize, and you get something like river-copper-lantern-mango: strong enough to trust, and simple enough to remember.

How to use it

1
Choose password or passphrase
Pick a random character password for anything a password manager will store, or a word passphrase for a secret you need to remember and type. A new one is generated the moment you open the tool, entirely in your browser.
2
Tune it to the requirements
For a password, set the length and which character sets to include, and optionally avoid look-alike characters. For a passphrase, choose the number of words, the separator, and capitalization. Every change re-mints the secret instantly so what you see always matches the controls.
3
Read the strength
Watch the meter as you adjust: it shows the real entropy in bits and an honest estimate of how long an offline attacker would take to crack it. Longer is almost always the biggest single win, more so than adding another symbol type.
4
Copy it
Hit copy and paste the secret straight into your password manager or the field that needs it. Copying asks you to sign in with a free account, which is the only thing an account is for; generating and rating are always free and never require one.

Common mistakes

Using a generator that runs on a server

If a password is generated anywhere but your own device, it has been seen by a machine that is not yours, and possibly written to its logs, before you ever use it. Only trust a generator that works entirely in the browser and says so plainly. This one never transmits, logs or stores the secret it makes for you.

Choosing complexity over length

Swapping an o for a 0 barely helps; adding characters helps enormously. Each extra character multiplies the number of possibilities an attacker must try, so a longer password from a smaller set almost always beats a short one bristling with symbols. When you have to choose, spend your effort on length, which the strength meter here makes obvious as you drag the slider.

Reusing one strong password everywhere

Even a perfect password becomes a liability the moment it is reused, because a single breach at any one site then unlocks all of them. Generate a fresh, unique password for every account and let a password manager remember them. The manager is what makes long random passwords practical in the first place.

Trusting a strength bar that only sees the result

A meter that scores a finished string is guessing, and it is fooled easily in both directions. The only accurate strength figure comes from knowing how the secret was generated, which is why this tool reports true entropy in bits rather than a coloured bar based on whether you happened to include a symbol.

Questions

Are these passwords generated privately in my browser?: Yes, entirely. Every password and passphrase is created on your own device using crypto.getRandomValues, the browser's cryptographically secure random generator. Nothing is sent to a server, written to a log or stored anywhere. Signing in is only needed to copy a result so your work can follow you across our other tools; the generating and the strength rating never require an account, and the secret itself never leaves the page.
What makes this randomness secure?: It uses the Web Crypto API's getRandomValues, which is seeded from the operating system's entropy and designed to be unpredictable, rather than Math.random, which is not cryptographically secure and can in principle be predicted. Each character is also drawn with rejection sampling so every option is exactly equally likely, avoiding the small bias a naive approach introduces. That combination is what makes the output genuinely unguessable rather than merely random-looking.
How is the strength number calculated?: It is the true entropy of the generation process, not a guess about the finished string. For a password it is the length multiplied by the base-two logarithm of the character-pool size; for a passphrase it is the number of words multiplied by the base-two logarithm of the wordlist size. That gives the number of bits of genuine unpredictability, which is then turned into a crack-time estimate against an offline attacker at a hundred billion guesses a second. Because it is arithmetic on how the secret was made, it is exact.
Is a passphrase really as strong as a random password?: It can be, and it is far easier to remember. Strength comes from unpredictability, and a passphrase of several words chosen at random from a large list has a great deal of it: four or five random words is genuinely hard to crack, while still being something you can type or say aloud. A random character string packs more entropy per character, so it is the better choice for secrets a password manager will store. The meter shows the real entropy for both, so you can see the trade rather than guess at it.
How long should my password be?: Length is the single most important factor, because each extra character multiplies the search space. For anything a password manager stores, sixteen characters or more of mixed types is a strong baseline and longer is better, since you never have to type it. For a passphrase you will remember, four or five random words is a good target. Rather than aim for a fixed number, watch the entropy meter and choose a setting that lands solidly in the strong range for how the secret will be used.
Should I still use two-factor authentication?: Yes, always, where it is offered. A strong unique password protects an account if a site's password database is breached, but two-factor authentication protects it even if the password itself is stolen through phishing or malware, because the attacker still lacks the second factor. The two work together: strong generated passwords in a manager, plus a second factor on anything that matters. Building that layered protection into a real product is the kind of work our team does when the stakes are higher than a single login.

Related tools

Need this done properly, at scale?

The tool handles the one-off. When it's a system you're building, that's the paid version of the job, and we do that too.

Custom Software Development