Password generator
Generate strong, random passwords and passphrases locally.
Have feedback or an idea for this tool?
What makes a strong password?
A password strength comes from entropy, the number of guesses an attacker would need, which grows with both length and the size of the character set you draw from. A long random string mixing uppercase, lowercase, digits and symbols resists brute-force and dictionary attacks far better than a short or predictable one. This generator builds passwords and passphrases in your browser using the operating system cryptographic random source, and lets you set the length and which character types to include. Nothing you generate is sent over the network. Enter your preferences and copy the result. Use a long unique password for every account and store them in a password manager rather than reusing one. Use the tool to create a strong credential for a new server, database or account without inventing one by hand.
Key facts
- A password's strength is measured by its entropy in bits, which equals its length multiplied by log2 of the character-set size, so adding length raises strength faster than adding one more symbol.
- For a 94-character printable ASCII set, a 12-character random password gives roughly 79 bits of entropy, a 16-character one about 105 bits and an 8-character one only about 52 bits.
- A passphrase's strength comes from the word-list size and word count, and with a 7,776-word EFF/Diceware list each word adds about 12.9 bits, so four random words is about 51 bits.
- A cryptographically secure password should be drawn from a secure random source such as the browser's crypto.getRandomValues Web Crypto API or Python's secrets module, not from Math.random.
- NIST SP 800-63B advises favouring length, allowing all characters up to at least 64, screening against breached-password lists, and not forcing periodic rotation without a reason.
Why length beats complexity
A password's real strength is its entropy - the number of guesses an attacker needs on average, measured in bits. Entropy is length multiplied by log2 of the character-set size, so each extra character adds a fixed number of bits while the set stays the same. Adding length grows the search space far faster than adding one more symbol to a short password.
For a set of 94 printable ASCII characters, each character is worth about 6.55 bits. A 12-character random password is roughly 79 bits; a 16-character one is about 105 bits; a 20-character one about 131 bits. This is why we default to 16 or more and offer 8, 12, 16, 20 and 25 - an 8-character password, even with symbols, is only about 52 bits and is brute-forceable offline.
Complexity rules ('must contain an uppercase, a digit and a symbol') push people toward predictable patterns like 'Password1!' that machines guess quickly. A longer string from a mix of sets, or a multi-word passphrase, gives more real entropy than a short one bristling with special characters.
Passphrases vs random strings
A random string like 'k7$Qp2vX9mL!' is dense but hard to type and remember. A passphrase - several unrelated words chosen at random, such as 'harbor-violet-anchor-comet' - reaches the same entropy at a length you can actually memorise, which is why this tool offers a words mode.
The strength of a passphrase comes from the size of the word list and the number of words, not from the words looking clever. With a 7,776-word list (the EFF/Diceware size) each word adds about 12.9 bits, so four random words is about 51 bits and six words is about 77 bits. Use passphrases for secrets you must type by hand - disk encryption, a password-manager master password, an SSH key passphrase - and random strings for everything a manager fills in for you.
Generated in your browser, nothing sent anywhere
Every password and passphrase here is created client-side using the browser's cryptographically secure generator (the Web Crypto crypto.getRandomValues API), not Math.random and not a server. The values never leave your machine, so they are not logged, transmitted or stored by us.
This matters because a secret is only secret if nobody else ever saw it. Generating on a remote server, even over HTTPS, means the secret existed on someone else's machine. Generating locally means it exists only in your browser tab until you use it. You can confirm this yourself by loading the page and then turning off your network - generation still works.
Use a password manager and never reuse
The single most effective habit is a unique password for every account, stored in a password manager (Bitwarden, KeePassXC, 1Password or similar). Reuse is what turns one site's breach into a takeover of your email, bank and cloud console through credential-stuffing, where attackers replay leaked pairs across services.
This lines up with NIST SP 800-63B, the widely cited guidance: favour length, allow all characters including spaces up to at least 64, screen new passwords against known-breached lists, and do NOT force periodic rotation without a reason - scheduled expiry pushes people toward weak, incremental passwords. Change a password when you have evidence it was exposed, not on a calendar. Let the manager generate and remember a long random secret per site, and protect the vault with a strong passphrase plus multi-factor authentication.
Glossary
- Entropy
- The measure of a password's strength in bits, equal to its length multiplied by log2 of the character-set size, representing how many guesses an attacker needs on average. Adding length raises entropy faster than adding one more symbol to a short password.
- Passphrase
- A secret made of several unrelated words chosen at random, such as harbor-violet-anchor-comet, that reaches high entropy while staying memorable. Its strength comes from the word-list size and word count; with a 7,776-word list each word adds about 12.9 bits.
- Cryptographically secure random source
- A generator suitable for secrets, such as the browser's crypto.getRandomValues Web Crypto API or Python's secrets module, whose output cannot be predicted. Ordinary functions like Math.random are not secure and must not be used to generate passwords.
- Brute-force attack
- An attack that tries every possible password until one matches, which offline against a leaked hash can reach billions of guesses per second on a GPU. An 8-character password of about 52 bits is brute-forceable this way, while length pushes the search space out of reach.
- Password manager
- Software such as Bitwarden, KeePassXC or 1Password that generates, stores and fills a unique long password for every account. Using one and never reusing a password stops a single site's breach turning into account takeover through credential-stuffing.
- Credential stuffing
- An attack that replays username-and-password pairs leaked from one breach against many other services, succeeding wherever a password was reused. A unique password per account, kept in a password manager, is the defence.
Questions, answered.
Are the passwords generated on a server or sent anywhere?+
No. Every password is generated in your browser using the built-in cryptographically secure random generator (Web Crypto), and nothing is transmitted, logged or stored by us. You can even generate with your network disconnected.
How many characters should a password be?+
For a random password, 16 characters is a sensible default and gives roughly 105 bits of entropy with a full character set. Twelve is an acceptable minimum for online accounts, 20 or more suits high-value logins, and 8 is too short for anything you care about because it can be brute-forced offline.
What makes a password strong?+
Entropy, which comes mainly from length and from how many character sets you draw on. A long password or a multi-word passphrase beats a short one padded with symbols. Forced-complexity patterns like 'Password1!' are weak because attackers guess those shapes first.
Are random passwords or word-based passphrases better?+
Both can be equally strong; it depends on use. Random strings are ideal for anything a password manager fills in for you. Passphrases of four to six random words reach the same entropy while staying memorable, so use them for secrets you must type - a master password, disk encryption or an SSH key passphrase.
Should I ever reuse a generated password?+
No. Use a unique password for every account and keep them in a password manager. Reuse lets a breach on one site unlock the others through credential-stuffing, where attackers replay leaked username-and-password pairs across services.
How often should I change my passwords?+
Only when there is a reason - a breach, a suspected compromise or a shared secret leaving the team. NIST SP 800-63B advises against forced periodic rotation, because scheduled expiry pushes people toward weak, predictable changes. A long unique password in a manager plus MFA is stronger than one you keep rotating.
Can I generate many passwords at once?+
Yes. Bulk mode produces a whole list in one go, which is handy when you are seeding database users, VM credentials or test accounts and want a fresh, unique secret for each. They are generated locally like the single passwords.
Is this the same as generating a password in Python or a browser extension?+
The principle is the same - draw random bytes from a cryptographically secure source (Python's secrets module, or the browser's Web Crypto here) rather than an ordinary random function. This tool just puts a secure generator and passphrase mode in the browser with nothing installed and nothing sent to a server.
Cloud that speaks India.
These tools run on ServerCake infrastructure in India. When our cloud opens, you get VMs and managed databases priced in ₹, billed with GST, on India-resident infrastructure. Reserve your spot for early access.
Reserve your spot