Password Generator

Free, instant, 100% local — passwords never leave your browser.

Your passwordGenerated locally
 
406480100128

 estimated entropy

Character types
Advanced options

This free password generator creates strong, random passwords directly in your browser. Nothing is sent to a server, nothing is stored, and no account is required. Adjust the length, pick your character types, and copy — or generate up to 50 at once.

Why a strong password generator matters

Credentials remain one of the main ways attackers get in. In the 2026 Verizon Data Breach Investigations Report, credential abuse appears somewhere in 39% of all breaches.

Something did change that year, and it is worth stating plainly. Vulnerability exploitation overtook stolen credentials as the single biggest entry point for the first time in 19 years, at 31% of breaches.

That does not make passwords a solved problem. Identity-based entry points combined — phishing at 16% plus credential abuse at 16% — still edge out vulnerabilities at 32%.

Reused passwords turn one breach into many

A password only used once fails once. The same password across a dozen accounts turns a single leak at the weakest site into access everywhere else.

Attackers automate this. They take credentials from one breach and replay them against hundreds of other services, which is why a unique value per account matters more than any clever pattern.

This is the practical case for using a password generator at all: it makes a distinct password per account the path of least effort rather than a chore.

Human-invented passwords are predictable

People reach for the same shapes: a capital at the front, a familiar word in the middle, a digit and a punctuation mark at the end. Cracking tools encode those shapes as rules and try them first.

A password generator has no such habits. Every position is chosen independently, which is precisely what makes the result expensive to guess.

Length beats complexity

NIST settled this argument in SP 800-63B. Section 3.1.1.2 states that verifiers“SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.”

In other words, the national standards body explicitly rejects forced character-type mixing. What it requires instead is length: a minimum of 15 characters when a password is the only factor.

Password length contributes more strength than character complexity A bar chart comparing the entropy of three randomly generated passwords. A 9-character password using every character type reaches about 59 bits. A 19-character password using only lowercase letters reaches about 89 bits, which is stronger despite using a much smaller character set. A 16-character password using every character type reaches about 105 bits. Length beats complexity Entropy of three randomly generated passwords. More characters outweighs more character types. k7#Rm2$Xp 9 characters · all types 59 bits qmxvbtreklsahdwocpz 19 characters · lowercase only 89 bits k7#Rm2$Xp9!vLz4Q 16 characters · all types 105 bits Ten more characters — even without symbols, numbers, or capitals — adds 30 bits of entropy. Entropy = length × log₂(character set size). Each additional bit doubles the work an attacker must do. Applies to randomly generated passwords only. A long password you invented yourself carries far less real entropy than this formula suggests.
A 19-character lowercase-only password carries more entropy than a 9-character password using every character type.Entropy = length × log₂(character set size). Applies to randomly generated values only.

What is a password generator?

A password generator is a tool that creates a random password from a character set you choose, using a cryptographically secure source of randomness. Unlike a password you invent, a generated password has no pattern, no personal meaning, and no reuse.

How random password generation actually works

A password generator asks the operating system for random bytes, maps each byte onto your selected character set, and repeats until it reaches the requested length.

The mapping step matters more than it looks. Taking a random byte modulo the alphabet size biases the result toward the first few characters whenever the alphabet is not a power of two — which is nearly always. This tool uses rejection sampling instead, so every character is equally likely.

Cryptographic randomness versus pseudo-randomness

Browsers expose two sources of randomness, and only one is safe here.

Math.random() starts from a seed and runs a deterministic algorithm. Recover the seed and you can reproduce the entire sequence. It is fine for shuffling a playlist and unacceptable for a password.

crypto.getRandomValues() draws from the operating system's entropy pool, fed by hardware noise and timing jitter. There is no seed to recover. Every value on this site comes from it.

Math.random compared with crypto.getRandomValues A side-by-side diagram of two random number sources. Math.random starts from a seed and runs a deterministic algorithm, so the same seed reproduces the same sequence and the output is predictable — it must never be used for passwords. crypto.getRandomValues draws from the operating system entropy pool, which is fed by hardware noise, timing jitter and interrupts, then passes it through a cryptographically secure generator, producing output that cannot be reproduced or predicted. Not all randomness is equal Where the random numbers come from decides whether a password can be predicted. Math.random() pseudo-random Seed value from clock or state Deterministic algorithm 0.7328… 0.1194… 0.9051… Same seed reproduces the same sequence. Never use it for passwords, keys, tokens, or secrets. crypto.getRandomValues() Operating system entropy pool hardware noise · timing jitter · interrupts Cryptographically secure generator k7#Rm2$Xp9!vLz4Q No seed to recover. Output cannot be reproduced. This is what every generator on this site uses. Both are available in every modern browser. Only the second one is part of the Web Crypto API and suitable for security use.
Both functions exist in every browser. Only the Web Crypto API is suitable for passwords, keys and secrets.

What password entropy means

Entropy measures how many guesses an attacker needs, expressed in bits. Each additional bit doubles that number.

A 16-character password drawn from 85 possible characters carries about 103 bits. That figure appears live above the settings as you change them.

Password generator versus passphrase generator

A password generator produces a dense string of characters. A passphrase generator produces several random words joined together.

Passphrases reach comparable entropy through length rather than density, which makes them far easier to type on a phone or read aloud. Use a password where software fills it in for you, and a passphrase where a human has to handle it.

How to use this password generator in 4 steps

Step 1 — Set your password length

Drag the slider or click a preset. This password generator defaults to 16 characters.

That default is not arbitrary: NIST requires at least 15 characters for a single-factor password, so 16 clears the standard with a margin.

Step 2 — Choose character types

Leave all four types enabled unless a specific system forces you to do otherwise. More character types means a larger pool and more entropy per character.

Some older systems reject symbols. If you hit one, turn symbols off and raise the length to 20 or more — the extra characters more than repay the smaller pool.

Step 3 — Check strength and entropy

Most tools stop at a vague label. This password generator also shows the exact entropy: the meter fills in five bands, and the scale beneath it marks where your password falls in bits.

Password entropy scale in bits A scale showing password strength measured in bits of entropy. Below 40 bits is very weak, typical of an 8-character lowercase password. 40 to 64 bits is weak. 64 to 80 bits is fair. 80 to 100 bits is strong. Above 100 bits is very strong. The default on this site, a 16-character password using all character types, reaches about 105 bits. Reading the entropy value Entropy is measured in bits. Every extra bit doubles the number of guesses an attacker needs. Default here: 16 chars, all types ~105 bits 40 64 80 100 128 Very weak Weak Fair Strong Very strong 8 chars lowercase 8 chars all types 12 chars mixed case 16 chars alphanumeric 16 chars all types Estimated entropy for randomly generated values. A password you invented yourself has far less entropy than its length suggests.
Anything above 100 bits is very strong. The default 16-character setting lands at roughly 103 bits.

Reading the entropy value

Below 40 bits is trivially crackable. Between 64 and 80 is adequate for low-value accounts. Above 100 bits is beyond brute force with any foreseeable hardware.

Step 4 — Copy, or generate in bulk

Click Copy and paste the result straight into the account you are creating. The button confirms with a brief “Copied!” and reverts. Nothing about the copied value leaves the page.

Generating up to 50 passwords at once

Open Advanced options and raise the quantity. The output becomes a list you can copy in one go or download as a text file — useful for onboarding a team or seeding test data.

What you can do with this password generator

Everyday account passwords

Generate one per account, paste it in, and let your password manager store it. The value of a password generator comes from never reusing what it produces.

If an account needs a password you must type by hand on a TV or console, a memorable password is the better shape.

Bulk passwords for teams and onboarding

Setting up 20 accounts is where bulk mode pays off. Generate the batch, download the text file, distribute through a secure channel, and require a change on first login.

Developer secrets and API credentials

A general password generator is the wrong shape for most machine credentials: they usually need a specific encoding or fixed length rather than a mixed character set.

For those, use the dedicated tools: API keys, secret keys, JWT signing secrets, salts, or a raw random string when you control the format.

Wi-Fi, router and device passwords

Router admin pages and Wi-Fi keys are typed rarely and attacked often, which makes them ideal candidates for a long generated value.

For a keypad or PIN-only device, use the PIN generator instead.

How long should your password be?

Password cracking time by length and character set A matrix showing estimated offline brute-force cracking time for passwords from 4 to 20 characters across five character sets. Longer passwords using a smaller character set consistently outperform shorter passwords using a larger one. For example, a 20-character lowercase-only password takes roughly 317 million years to crack, while a 12-character password using all character types takes roughly 8,700 years. How long does it take to crack a password? Estimated time for an offline brute-force attack at 10¹² guesses per second, averaged over half the keyspace. Numbers 0-9 · 10 Lowercase a-z · 26 Mixed case A-Za-z · 52 Alphanumeric +0-9 · 62 All characters +symbols · 95 LENGTH 4 Instant Instant Instant Instant Instant 6 Instant Instant Instant Instant Instant 8 Instant Instant 27 seconds 2 minutes 55 minutes 10 Instant 1 minute 20 hours 5 days 1 year 12 Instant 13 hours 6 years 50 years 8,700 years 14 50 seconds 1 year 16K years 195K years 78M years 16 1.4 hours 690 years 46M years 750M years 710B years 18 6 days 470K years 123B years 2.9T years 6×10¹⁵ years 20 1.6 years 317M years 333T years 1×10¹⁶ years 6×10¹⁹ years 20 lowercase letters beat 12 mixed characters by ~36,000× Length adds more strength than complexity does. Under 1 hour Hours to days Years to centuries Thousands of years Over a million years Assumes a fast unsalted hash (MD5/SHA-1) attacked offline. Slow hashes such as bcrypt or Argon2 take vastly longer. Time = charset^length ÷ 2 ÷ 10¹² guesses per second. onepassword.net
Estimated offline brute-force time by length and character set. Note that 20 lowercase letters beat 12 mixed characters by roughly 36,000 times.Calculated as charset^length ÷ 2 ÷ 10¹² guesses per second, assuming a fast unsalted hash. Slow hashes such as bcrypt or Argon2 take vastly longer.

8 characters is no longer safe

An 8-character password using every character type falls in under an hour to an offline attack on a fast hash. Eight characters was a reasonable floor in 2005. It is not one now.

12 characters is the practical minimum

Twelve mixed characters reach roughly 8,700 years. That is adequate for accounts you do not care much about, and below what NIST now asks for.

16 characters is the recommended default

Sixteen characters clears the NIST 15-character floor and lands above 100 bits of entropy. It is long enough that length stops being the weak link, and short enough that pasting it never causes trouble.

When to go to 24 or 32

Raise it for accounts that can reset other accounts: your email, your password manager, your domain registrar, your bank.

Beyond about 32 characters the added entropy is academic — the attack will target you, your device, or a password reset flow long before it targets the password.

Is an online password generator safe?

It depends entirely on where the password is created. Whether an online password generator is safe is a structural property of how it is built, not a promise in its marketing copy.

Where your password is created

Local password generation compared with server-side generation A diagram contrasting two designs. On this site the Web Crypto API creates the password inside your browser and you copy it directly, so nothing ever crosses the network boundary. In a server-side generator the request travels across the network to a server, where the password can be recorded in server logs, written to a database, and captured in backups — three points where it can be exposed. Where your password is actually created The difference is not how strong the password is. It is how many places it can leak from. NETWORK BOUNDARY THIS SITE YOUR BROWSER Web Crypto API Password created You copy it Nothing crosses this line. Zero network requests. Nothing to log, store, intercept, or subpoena. A SERVER-SIDE GENERATOR Your browser sends a request password in transit Server generates it for you Server logs Database Backups Four places it can leak from instead of none — and you cannot audit any of them from outside. Verify it yourself: open your browser's network panel and generate a password, or disconnect from the internet and try again. onepassword.net
On this site the password is created inside your browser, so it never crosses the network boundary. A server-side generator gives it at least four places to leak from.

This password generator runs entirely in your browser. There is no request to log, no database row to leak, no backup to subpoena, and no server-side history that can be breached later.

How to verify it yourself

Do not take our word for it. There are three checks, and each takes under a minute.

  • Disconnect from the internet and reload this page from cache. It still generates passwords.
  • Open your browser's developer tools, switch to the Network panel, and generate. No request appears.
  • View the page source and read the code that produces the value.

A password generator that builds the value on a server cannot pass any of those three checks.

What to do after you generate a password

Paste it directly into the account you are creating, then store it in a password manager.

Avoid the common failure modes: emailing it to yourself, saving it in a notes app, or keeping a spreadsheet of credentials. Each of those turns a strong password back into a weak one.

Password generator versus password manager

A password generator and a password manager solve different halves of the same problem, and this site only solves one of them.

This is a generator, not a password manager. It creates values. It does not store them, sync them, or fill them in for you — and it is not affiliated with any password manager product.

CapabilityThis generatorA password manager
Creates strong random passwordsYesYes
Stores them for youNoYes
Syncs across devicesNoYes
Fills them in automaticallyNoYes
Requires an accountNoYes
PriceFreeFree to paid

Use both. Generate here, store there. A password generator plus a manager covers the whole workflow; a strong password you cannot store safely helps nobody.

Frequently asked questions

Is this password generator really free?

Yes. Every generator on this site is free, with no limit on how many passwords you create. There is no account, no email gate, and no paid tier. This site has no premium version to upsell you into.

Do I need to create an account to use it?

No. Passwords appear the moment the page loads. We do not ask for an email address, and we set no cookies that identify you.

Are the generated passwords stored anywhere?

No. Passwords are created in your browser with the Web Crypto API and never leave your device. They are not sent to a server, not written to a database, not saved in browser storage, and not included in any analytics event. Closing the tab destroys them permanently.

How is this different from the 1Password or LastPass generator?

Those tools are entry points for paid password managers, so they stay deliberately simple. This one is the product. It offers bulk generation up to 50 passwords, an exact entropy readout in bits, custom character exclusion, and length presets, none of which the password manager tools provide.

How long should my password be?

Use 16 characters as your default. Go to 20 or more for email, banking, and any account that can reset your other accounts. NIST now requires a minimum of 15 characters for passwords used as a single factor, so 16 clears that bar with room to spare.

What should I do with the password after I generate it?

Paste it straight into the account you are creating, then save it in a password manager. Do not email it to yourself, keep it in a notes app, or put it in a spreadsheet. If you need something you can actually memorise, use a passphrase instead.

Can I generate more than one password at a time?

Yes. Open Advanced options and set the quantity to 5, 10, 25, or 50. Bulk output can be copied in one click or downloaded as a plain text file, which helps when you are setting up several accounts or seeding a test environment.

Is a randomly generated password better than one I invent myself?

Yes, and by a wider margin than most people expect. Human-chosen passwords cluster around predictable shapes: a capital letter first, a word in the middle, a number and symbol at the end. Cracking tools target those shapes directly. A generated password has no shape to target.

More free generators

Every generator here runs locally in your browser, with no account and no limits. If you need something other than a password generator, start below.

Methodology

Last updated

How entropy is calculated

entropy = length × log₂(character set size)

The character set size is the pool actually in use after your exclusions are applied, not the theoretical maximum. Values are rounded down for display because entropy is an estimate, not a measurement.

How the cracking-time estimates work

time = charsetlength ÷ 2 ÷ 10¹² guesses per second

The figures assume an offline attack against a fast unsalted hash such as MD5 or SHA-1, at 10¹² guesses per second, averaged over half the keyspace. A slow hash designed for passwords — bcrypt, scrypt, Argon2 — takes many orders of magnitude longer. These are order-of-magnitude comparisons, not predictions.

Where the randomness comes from

Every value is produced by crypto.getRandomValues() in your browser.Math.random() is never used. Character selection uses rejection sampling to avoid the modulo bias that would otherwise favour the start of the alphabet.