Tools · Security
Password generator
Strong random passwords and passphrases from your browser’s cryptographic randomness — with the entropy arithmetic and honest crack-time estimates shown, not a mystery traffic light. Never transmitted, never stored.
very strong · 129.5 bits of entropyoffline crack ≈ 2×10^19 centuries · online ≈ 2×10^25 centuries
Generated by your browser’s cryptographic randomness, on your device. Never transmitted, never stored — not even in this browser. Copy it straight into your password manager.
Questions people actually ask
- Is it safe to generate a password on a website?
- It depends entirely on where the generation happens. Here it runs in your browser using crypto.getRandomValues — the same cryptographic randomness your browser uses for TLS. The password is never transmitted, never logged, and never stored, not even in this browser. You can disconnect from the internet and this page keeps working.
- What do the "bits of entropy" mean?
- Entropy measures how many guesses an attacker needs: n bits means 2ⁿ possibilities. We compute it as length × log₂(pool size) and translate it into time at two stated attack rates — 10 billion guesses/second for an offline attack on a stolen password database, 10 thousand/second for a throttled online attack. Most meters show a colour; we show the arithmetic.
- Password or passphrase?
- A 20-character random password is stronger per character, but a 6-word passphrase is far easier to type and remember when you occasionally must (a laptop login, a password manager master password). For everything else, use random passwords — stored in a password manager, never reused.
- How long should a password be in 2026?
- Sixteen random characters from a full character pool is a sensible floor — around 100 bits of entropy, which stays out of reach of offline cracking even against a stolen, poorly-hashed database. Length beats cleverness: each added character multiplies the attacker’s work, while substitutions like "P@ssw0rd" barely register, because cracking tools try those substitutions first.
- Is a random password safer than one I invent myself?
- Yes, and it is not close. Human-invented passwords cluster around names, dates, keyboard walks and predictable substitutions — exactly the patterns cracking dictionaries encode. Randomness has no pattern to exploit, which is the entire point: the entropy figure shown here is only honest because every character is drawn independently.
- Why should every account get a different password?
- Because breaches leak in bulk and attackers replay leaked email-and-password pairs against every other service — credential stuffing. A reused password turns one breached forum into access to your email, and your email resets everything else. Unique random passwords make a breach a contained event instead of a chain reaction.