Skip to main content
toolsxulo

Password Generator

Generate strong random passwords or memorable passphrases, with a strength meter.

E|DT2l0Pre->5M6:
Very strong103 bits · would take ~essentially uncrackable to crack
Length16
Advanced options

Generate multiple

Everything here is generated locally in your browser using a cryptographically secure random number generator. Nothing is transmitted, saved, or shared - refresh the page and it's gone for good, so copy or save what you need before navigating away.

How it works

Random passwords are built character by character from a cryptographically secure random number generator (not the ordinary Math.random(), which isn't safe for anything security-sensitive) - every enabled character type (uppercase, lowercase, numbers, symbols) is guaranteed to appear at least once, then the rest is filled and shuffled. Passphrases instead pick several random common words from a built-in list and join them together - easier to type and remember than a random string, while still resistant to guessing because of how many words are in the list and how many are combined.

Read the full guide

How to use it

  1. Choose Random characters or Passphrase.
  2. Adjust length (or word count), character types, and any exclusions - the result updates instantly.
  3. Copy it, or use Generate multiple to create and download a whole batch at once.

Examples

16-character random, all typesK7#mPz2$qLxN9!wR
5-word passphrase, capitalizedComet-Harbor-Willow-Quartz-42

Frequently asked

Are these passwords sent anywhere or saved?
No. Everything is generated and displayed entirely in your browser using the Web Crypto API - nothing is transmitted to a server, and unlike every other tool on this site, this one deliberately skips URL-sharing and saved-state features, since a password is a secret that shouldn't end up in a shared link or local storage.
Is a passphrase as secure as a random password?
It depends on length: a 5-word passphrase from this tool's word list has roughly the same guessing resistance as a random ~41-character-pool password of similar entropy, and it's much easier to type and remember. Add more words for more security.
What does the strength meter actually measure?
It calculates entropy in bits from the size of the character pool (or word list) and the length, then estimates how long an offline attacker guessing 10 billion combinations per second would take on average - a standard, if conservative, way to communicate password strength.
Why guarantee at least one character from each selected type?
With pure randomness, a long password could occasionally end up with zero digits or symbols even though those options were checked - many password policies would then reject it. Guaranteeing one of each avoids that frustration without weakening the result.