How to use the strong password generator
Step 1 — Pick the kind of password you need
Five modes sit above the controls. Random is the default and the strongest per character. Passphrase gives you words you can actually remember. PIN is digits only. Pronounceable trades strength for something you can say aloud. Pattern matches a format a system demands. The strength meter updates for whichever you choose.
Step 2 — Set the length
Length buys more security than complexity does. A 20-character password drawn from lower case alone is stronger than a 10-character one using every symbol on the keyboard, because each extra character multiplies the search space. The slider runs to 128; 16 to 20 is a sensible floor for anything that matters.
Step 3 — Choose character sets and refinements
Uppercase, lowercase, numbers and symbols can each be switched off for systems that reject them. Use at least one of every set satisfies validators that demand a digit or a symbol. Avoid look-alikes drops 0O1lI| for passwords you will read off a screen or dictate. No repeated characters and the exclusion box handle the rest.
Step 4 — Read the strength meter honestly
The meter reports entropy in bits, not a vague “strong” badge. Bits are the real measure: each extra bit doubles the work an attacker must do. Underneath, the crack-time estimate is given at two realistic attack speeds — 100 billion guesses a second against a fast hash, and 10,000 a second against a slow one such as bcrypt.
Generating several at once
Generate 10 produces a batch with the entropy of each, copyable individually or all together, and exportable as CSV. Useful when setting up several accounts or seeding a team’s credentials, though the CSV should be imported into a password manager and deleted rather than kept.
Nothing leaves your browser
Passwords are generated locally by crypto.getRandomValues(), your browser’s cryptographic random source. They are never sent to a server, never written to local storage, and the session list disappears the moment you reload or close the page. You can confirm this by loading the page, disconnecting from the internet, and generating — it still works.
About the strong password generator
This tool creates passwords that are genuinely unpredictable, and tells you honestly how strong each one is. It generates random character strings, memorable passphrases, numeric PINs, pronounceable passwords and passwords matching a custom pattern — all in your browser, with nothing transmitted anywhere.
Where the randomness comes from, and why it matters
A password generator is only as good as its source of randomness, and this is the detail most tools get wrong. JavaScript’s Math.random() is a pseudo-random generator: fast, fine for shuffling a playlist, and explicitly not designed for security. Its internal state is small, and given a modest sample of its output an attacker can reconstruct that state and then predict every value it will produce next — and every value it produced before. A password built from it looks random but is not.
Every draw in this tool comes from crypto.getRandomValues(), the Web Crypto API’s cryptographically secure generator, which the browser seeds from the operating system’s entropy pool. On top of that, index selection uses rejection sampling rather than the usual modulo trick. Taking value % 26 from a 32-bit number does not divide evenly, so the first few letters of the alphabet would come up very slightly more often than the rest. The bias is small, but on a security tool it should not exist, so values landing outside an exact multiple of the range are discarded and redrawn.
You do not have to take this on trust. Generating several thousand single characters from a lowercase-only pool and testing the distribution gives a chi-square value comfortably inside the range you would expect from a uniform source.
Who this is for
- Anyone creating a new account who wants a password that is not a variation of an old one.
- People who need to remember it — the passphrase mode produces something you can hold in your head without writing down.
- Developers and administrators generating credentials in bulk, or needing a password that fits an awkward format rule.
- Anyone replacing a reused password after a breach notification.
The five modes explained
Random — the strongest per character
Draws each character independently from the enabled sets. With all four sets enabled the pool is 86 characters, giving about 6.4 bits per character — so a 20-character password carries roughly 128 bits, which is beyond any foreseeable brute-force attack. Use this for anything stored in a password manager, where you never have to type it from memory.
Passphrase — the one you can remember
Picks whole words at random from a fixed list of 1,978, one independent draw each. That is just under 11 bits per word, so a five-word passphrase carries around 55 bits and a seven-word one around 77. This is the Diceware method, and it is what both NIST and the UK’s NCSC now recommend over forced complexity rules, because a passphrase you can actually remember is one you will not write on a sticky note.
The important subtlety: the strength comes from the words being chosen randomly, not from the phrase being long. A memorable sentence you invented yourself is far weaker than it looks, because human word choice is highly predictable.
PIN — for devices and card readers
Digits only, with runs and repeats such as 1234 and 1111 rejected. Be realistic about what a PIN is worth: four digits is 10,000 possibilities, about 13 bits, which is nothing without rate limiting. PINs are secure only because the device locks after a few failed attempts. Use six or more digits wherever the system allows.
Pronounceable — memorability at a cost
Builds alternating consonant and vowel groups so the result can be said aloud. This is genuinely useful for passwords dictated over a phone or typed by someone else, but each syllable is drawn from a small set, so the entropy is far lower than the character count suggests. The meter shows the real figure rather than the flattering one.
Pattern — for systems with rigid rules
Some systems demand a specific shape. Write it with U for an uppercase letter, l for lowercase, d for a digit, s for a symbol, a for any letter and * for anything; every other character is kept literally. Literal characters carry no entropy, so a pattern heavy with fixed separators is weaker than its length implies — the meter counts only the tokens that are actually random.
What actually makes a password strong
Entropy, not complexity theatre
Entropy in bits measures how many guesses an attacker must make. Each extra bit doubles that number. P@ssw0rd! satisfies most complexity rules and is close to worthless, because the substitutions are the first ones any cracking dictionary tries. A five-word random passphrase looks simpler and is thousands of times harder to guess.
Length beats character variety
Adding one character to a 20-character password multiplies the search space by the pool size. Adding a symbol set to a short password multiplies it once. This is why modern guidance from NIST dropped mandatory complexity rules and raised the recommended minimum length instead.
Reuse is the real risk
Most account compromises do not involve cracking anything. Credentials leak from one breached site and are replayed against others — credential stuffing. A perfect password used in two places is weaker than two mediocre passwords used once each. This is the single most valuable habit to change.
Use a password manager
Unique passwords for every account are only practical with a manager. It also defeats phishing in a way memory cannot: a manager will not autofill a login form on a lookalike domain, because the domain does not match.
Turn on two-factor authentication
Even a perfect password can be phished or keylogged. A second factor — an authenticator app or a hardware key, in preference to SMS — means a stolen password alone is not enough. For high-value accounts this matters more than the last few bits of password strength.
Frequently asked questions
What makes a password strong?
Being long and genuinely random, and being used in exactly one place. Length matters more than symbol variety, randomness matters more than cleverness, and uniqueness matters more than both — because most compromises come from reused credentials rather than cracking.
How long should a password be?
At least 16 characters for anything that matters, and 20 or more where the system allows it and a manager will remember it for you. For a passphrase, five words is a reasonable floor and seven is strong. Anything under 12 characters is short by current standards.
How long would it take to crack my password?
The tool tells you, at two realistic speeds. As a rule of thumb: below 40 bits is crackable quickly, 60 bits resists casual attack, 80 bits is comfortable, and above 100 bits is beyond brute force with any foreseeable hardware. The figure depends heavily on how the site stores the password — a fast hash such as MD5 falls billions of times faster than bcrypt.
Is it safe to use an online password generator?
It depends entirely on whether the generation happens in your browser or on someone’s server. This one runs locally: nothing is transmitted, nothing is stored, and the tool keeps working with your connection switched off — which is the simplest way to verify the claim. Treat any generator that sends your password to a server, or that cannot work offline, with suspicion.
Does this tool store or send the passwords it creates?
No. Passwords exist only in your browser’s memory, are never written to local storage or cookies, and are gone when you reload or close the page. There is no analytics event carrying the password and no network request when you generate one.
What is password entropy, and how many bits do I need?
Entropy is the number of bits needed to describe how many equally likely passwords could have been produced. Each bit doubles the guessing effort. Aim for 60 bits minimum on ordinary accounts, 80 or more on email, banking and anything holding password resets for other services.
Is a passphrase better than a random password?
For anything you must type from memory, yes — a passphrase of the same strength is far easier to remember and to type on a phone. For anything a password manager will fill, a random string is more compact for the same entropy. Both are strong when the choice is genuinely random.
What is Diceware?
A method of building passphrases by selecting words at random from a numbered list, originally using physical dice. The security comes from the randomness of the selection rather than the length of the phrase. This tool applies the same principle using a cryptographic random source instead of dice.
Should I change my passwords regularly?
Not on a schedule. Forced rotation pushes people towards predictable variations — appending a number, incrementing it each quarter — which weakens security. NIST removed the recommendation in 2017. Change a password when there is a reason: a breach notification, a shared password, or any suspicion of exposure.
Are special characters required for a strong password?
No, though many systems still demand them. A long password without symbols beats a short one with them. Use symbols when a validator insists, and enable “Use at least one of every set” so the password passes on the first attempt.
Why does the generator avoid characters like 0, O, 1 and l?
Only if you ask it to. Those characters are easy to confuse when a password is read off a screen, written down or dictated. Switch the option on for passwords a human will handle, and leave it off for anything a password manager fills — excluding characters slightly reduces the pool and therefore the entropy.
Can I generate several passwords at once?
Yes — “Generate 10” produces a batch with the entropy of each, copyable individually or together, and exportable as CSV. Import the file into a password manager and delete it afterwards rather than leaving passwords in a spreadsheet.
Is this password generator free?
Free, with no sign-up and no limit on how many passwords you generate.