Tool
Password Generator
Generate a password, or check the strength of one you already use. Everything happens in your browser. Nothing you type gets sent, stored, or logged.
Pool size 88 · ~129.2 bits of entropy
The four modes, and when to use each
- Random
- Fully random characters from your selected classes. Highest entropy per character. Use for anything you will store in a password manager.
- Easy to read
- Random alphanumerics with visually ambiguous characters stripped (0, O, 1, l, I), grouped in blocks of four with hyphens. Good when the password has to be typed from a screen.
- Easy to say
- Pronounceable output built from alternating consonants and vowels. Loses some entropy per character in exchange for being dictatable over a phone.
- Passphrase
- Random words from the EFF large diceware list (7,772 words after removing hyphenated entries). Optional capitalisation and trailing digit. Use for master passwords and anywhere you need to memorise.
What actually makes a password strong
Length beats complexity
A 20-character lowercase password has around 94 bits of entropy. An 8-character password with uppercase, lowercase, numbers and symbols has around 52 bits. Every extra character roughly doubles the number of guesses an attacker has to try. Every extra character class only adds a one-time bump. Length is where the strength lives.
Passphrases work because words are long and memorable
The EFF diceware list holds 7,776 words. Picking 5 at random gives you 65 bits of entropy. That is roughly as strong as a 10-character fully random password, but you can type it on a phone keyboard, dictate it over a conference call, and remember it after three tries. That is why security engineers use passphrases for master passwords and disk encryption.
Never reuse a password
A few billion credentials leak from breached sites every year. Attackers take those exact email-and-password pairs and try them on every other site they can. If your bank password is also your password on some forum that got breached three years ago, the attacker already has your banking login. A unique password per account breaks the chain.
Use a password manager
The only realistic way to have a unique strong password for every site is to not remember them. 1Password, Bitwarden, or your browser's built-in manager all do the job. Memorise one strong passphrase for the manager itself and let the software carry the rest. Generate that one master passphrase in the passphrase mode above.
Turn on multi-factor authentication
Even a perfect password can be phished. Multi-factor authentication means the attacker needs a second thing, usually a code from an authenticator app, a hardware key, or a passkey. That second factor cannot be pulled from a leaked database. Turn MFA on for your email, your password manager, your bank, and anywhere else that offers it. App-based codes and hardware keys are safer than SMS codes.
How this tool handles your data
- Every password is generated inside your browser using
crypto.getRandomValues. - The strength meter runs zxcvbn locally. What you type into the analyzer stays in the tab.
- The diceware wordlist is fetched from this site's own origin the first time you switch to passphrase mode, then cached.
- The QR code is drawn to an in-page canvas by a client-only library. Nothing gets uploaded.
- The site uses Google Analytics for page-view counts. It does not observe the tool's inputs or outputs.
- Open DevTools → Network before you generate anything. You will not see any request go out.
Frequently asked
- Is this password generator safe to use?
- Yes. Every password is generated in your browser using crypto.getRandomValues, the same cryptographic random source your browser uses for TLS and passkeys. Nothing is sent to a server, nothing is logged, and nothing is stored beyond the current tab. Open your browser DevTools, look at the Network panel, and generate a password. You will not see a request go out.
- What is the strongest password mode?
- For raw entropy per character, random mode with all classes on is the strongest. For a password you actually need to remember, a 5 or 6 word passphrase from the EFF diceware list gives you 65 to 77 bits of entropy while staying typeable on a phone.
- Do symbols make my password stronger?
- Slightly. Adding a symbol class bumps entropy by about 5 bits total. Adding two more characters of length gives you 12 bits. Length is doing most of the work. Symbols are useful when a site requires them, or when you need to squeeze more strength into a fixed length.
- Why should I use a passphrase instead of a password?
- Two reasons. It survives being typed on a phone keyboard without cursing. And it survives being read out loud to another human without ambiguity. A random 12-character password fails both of those tests. A 5-word passphrase is roughly as strong and passes both.
- How long should my password be?
- For accounts you log into with a password manager, 16 to 20 random characters. For a master password to that manager, or a disk encryption passphrase, aim for 6 diceware words or a 20+ character random password.
- Does the QR code send my password anywhere?
- No. The QR is drawn to a canvas inside your browser by a client-only library. Nothing is uploaded. You can verify by opening DevTools, switching to the Network tab, then clicking QR.
- Does this tool work offline?
- Once the page loads once, most of it works offline. The passphrase mode fetches the diceware wordlist on first use and caches it, so if you plan to use passphrases offline, generate one online first.
- Can I use these passwords for real accounts?
- Yes. The random output uses cryptographic randomness, the same standard your password manager uses when it generates one for you. Save the result in a password manager rather than trying to remember it.
More tools
All tools →Password Strength Checker
Open →Paste any password and see how strong it really is. Entropy, estimated crack time, and specific suggestions. Never leaves your browser.
UUID Generator
Open →Generate UUIDs (v1, v3, v4, v5, v7) in any format. Batch up to 1000, download as TXT/CSV/JSON, or grab SQL-ready INSERT rows. Public API included.