Security · runs in your browser
Strong Password & Passphrase Generator
Create random passwords with your browser's secure random generator, or memorable multi-word passphrases. The strength meter shows real entropy, not a guess based on whether you added a symbol.
What actually makes a password strong
Length and randomness, mostly. A password you made up yourself, like Rahul@1995, follows patterns attackers try first: a name, a year, a capital at the start and a symbol before the number. A random 16-character string has no pattern to exploit.
Each character added multiplies the guesses needed, which is why length beats complexity. Going from 12 to 16 random characters makes a password millions of times harder to guess.
Good habits that matter more than the generator
- Never reuse passwords. When one site is breached, attackers try the same email and password everywhere else.
- Use a password manager (Bitwarden, 1Password, or your browser's built-in one) so every password can be long and unique.
- Turn on two-factor authentication for email, banking and anything that can reset your other accounts.
- Check for breaches of your email address at haveibeenpwned.com, and change passwords for any affected accounts.
About the crack-time estimate
The estimate assumes an attacker has stolen a password database and can test 10 billion guesses per second offline, which is plausible for powerful hardware against weakly protected passwords. Online attacks against a login page are far slower. Treat the number as a comparison between options, not a promise.
Frequently Asked Questions
Are these passwords really random?
Yes. They use the browser's cryptographically secure random number generator (crypto.getRandomValues), the same source used for encryption keys. Selection is done without 'modulo bias', so every character is equally likely.
Is the password sent to your server or saved anywhere?
No. Passwords are generated in your browser and never leave your device. Nothing is logged or stored; refresh the page and they're gone.
What does 'bits of entropy' mean?
It measures how many guesses an attacker would need: each extra bit doubles the work. Around 60 bits resists casual attacks, 80+ bits is very strong. A 16-character password using all four character types has about 103 bits.
Password or passphrase: which should I use?
For accounts you store in a password manager, use a long random password. For the few you must type or remember, such as the password manager itself or your laptop login, a passphrase of 7 or more random words is easier to type and still strong.
How strong are the passphrases here?
Words come from a list of about 730 common words, which gives roughly 9.5 bits per word. Seven words give about 67 bits; eight give about 76. That's a smaller list than the well-known EFF diceware list (7,776 words), so use one or two more words than you would with diceware.