Password Generator

This free online password generator creates random passwords and Diceware passphrases entirely in your browser. Choose a length and character sets, make a batch, exclude confusing characters or repeats, and copy the result. The strength meter shows estimated entropy and crack time; nothing is sent to a server.

Characters
Strength
Result
0 chars · 0 bytes
Try:
✓ Creates strong random passwords and passphrases ✓ Uses the secure Web Crypto API (crypto.getRandomValues) ✓ Live entropy and strength estimation ✓ Client-side processing only
Examples
Strong 16-character password
Password Length: 16

A 16-character mix of lowercase, uppercase, digits and symbols — a solid default for most accounts.

Readable 24 (no look-alikes)
Password Length: 24

Excludes look-alike characters like l, 1, O and 0 so the password is easy to type from a screen.

Diceware passphrase (6 words)
Passphrase Words: 6

Six random words from the EFF list — about 77 bits of entropy and far easier to remember than a random string.

Six-digit numeric PIN
Password Length: 6

Creates a random six-digit PIN for services that explicitly require numbers only. For a full account password, choose a longer password with more character sets instead.

What makes a strong password?

A strong password is long, random and unique to one account. Length and randomness are more important than a clever substitution or a memorable personal detail: each additional random character increases the number of possible combinations. This strong password generator estimates that uncertainty as entropy in bits and displays an indicative crack-time estimate. Treat the meter as a useful comparison, not as a guarantee; a password can still be exposed by phishing, malware or a breached service.

Use a different generated password for every account, save it in a trusted password manager, and enable multi-factor authentication where available. Never reuse a password, even a very strong one, across email, banking, work and social accounts.

How to create a random password

This password generator lets you choose the password length, lowercase letters, uppercase letters, digits and symbols. Select the sets that the website accepts, choose how many values you need, then generate and copy the result. It can create from 4 to 128 characters per password and up to 100 passwords at once.

For an account stored in a password manager, a 16-character password with letters, digits and symbols is a practical default. The generator also offers options to exclude similar characters such as l, 1, O and 0, exclude potentially ambiguous punctuation, and avoid repeated characters. These options can make a password easier to read or enter, but reducing the available character pool can also reduce entropy.

All random choices are made locally with the browser’s cryptographically secure crypto.getRandomValues API. Rejection sampling avoids modulo bias, and generated passwords are not transmitted, logged or stored by this service.

Passphrase generator: random password words

A passphrase generator builds a password from randomly selected words rather than a single opaque string. This tool uses the EFF Diceware word list and can join 3 to 20 random words with a hyphen, dot, space or underscore. You can also choose lowercase, capitalized or uppercase words and append a random digit.

Random password words are often easier to type and remember than a symbol-heavy string, provided the words are chosen at random rather than invented from a quote or personal information. A six-word Diceware passphrase has about 77 bits of word-selection entropy before any optional number is added. Use a passphrase when you must enter it frequently; use a long random password when a password manager will fill it for you.

Password length guide

Choose the longest unique password a service allows. An 8-character password is best reserved for older sites with strict limits and should use every permitted character set. A 10- or 12-character password can be acceptable when a site imposes a limit, but 14, 15 or 16 characters gives a stronger margin for important accounts. When the site permits it, choose 16 characters or more and let a password manager remember it.

There is no universally correct length because permitted character sets, rate limiting, multi-factor authentication and the way a service stores passwords all matter. The safest routine is simple: generate a new random password for each account, follow that service’s requirements, and replace it immediately if you suspect exposure.

FAQ

For accounts stored in a password manager, use 16 characters or more with all character sets enabled. For a password you must type or remember, a 4–6 word Diceware passphrase is a better trade-off between security and usability. Avoid anything shorter than 12 characters for important accounts.

Yes. Every password and passphrase is generated locally in your browser using the cryptographically secure Web Crypto API (crypto.getRandomValues) with rejection sampling to avoid bias. Nothing is transmitted to a server, logged or stored, so the values are yours alone.

Choose Password or Passphrase, set the length or word count and the options you need, then select Generate. You can create one value or a batch of up to 100 and copy the result. Use a fresh value for one account only and store it in a password manager when possible.

A random password is a string of characters and usually delivers high entropy in fewer characters. A Diceware passphrase combines randomly chosen words, making it longer but often easier to type and remember. Both can be strong when generated randomly and kept unique; choose the form that suits how you will use it.

Use every character set that the target site accepts, especially for a shorter password. For long passwords, length and randomness remain the main contributors to strength. If you must type a password manually, excluding look-alike or ambiguous characters may prevent errors; compensate by choosing a longer length.

A randomly generated 16-character password using a broad character set is a strong default for most accounts. A random 12-character password may be suitable where a service limits length, but longer is generally better. For an important account, use the longest unique password the site allows and enable multi-factor authentication.

Yes. In Password mode, enable Exclude similar characters to remove characters such as l, 1, O and 0, enable Exclude ambiguous characters to remove punctuation that can be hard to enter, or enable No repeats. No repeats is available only while the chosen length does not exceed the remaining unique character pool.

No. The meter estimates entropy from the selected generator settings and estimates crack time for the displayed result. It cannot protect against phishing, malware, a compromised device or password reuse. Use it to compare options, then protect each account with a unique password, a password manager and multi-factor authentication.
Related tools