About this tool
This password generator makes three kinds of secrets: random character passwords from 8 to 64 characters with your choice of lowercase, uppercase, digits, and symbols; passphrases of 3 to 8 words drawn from a built-in list of about 400 common English words; and numeric PINs. Options let you exclude look-alike characters such as l, 1, I, O, and 0, forbid repeated characters, and require every selected class to appear at least once. You can produce up to 20 at a time, copy one or all, or download them as a text file. Beside the results the page reports the entropy in bits, the size of the character pool, a strength label, and how long an attacker making ten billion guesses per second would need to try every possibility. It is for anyone setting up a new account, an administrator issuing temporary credentials, or a developer seeding API keys and test fixtures.
How it works
Randomness comes from crypto.getRandomValues, the browser's cryptographically secure generator, never Math.random. To pick one of n characters without bias the tool draws a 32-bit value and rejects it when it falls in the incomplete final block above the largest multiple of n (rejection sampling), so every character is exactly equally likely. When a class must be present, one character is chosen from each selected class first, the rest are drawn from the whole pool, and the result is shuffled with a Fisher-Yates shuffle driven by the same source. Entropy for a random password is length × log2(pool size); with no repeats it is the sum of log2 of the shrinking pool; a passphrase is words × log2(400) plus 6.6 bits for an appended two-digit number; a PIN is digits × log2(10). Crack time is 2^entropy divided by the assumed guess rate, so it is the worst case for the attacker and roughly twice the expected time.
Frequently asked questions
How long should a password be in 2026?
For anything protecting money, email, or identity, aim for at least 16 random characters from all four classes (about 105 bits) or a passphrase of 5 or more words (about 8.6 bits per word from a 400-word list, so 5 words is 43 bits and 6 words is 52). Random passwords stored in a password manager can be 24 to 32 characters since you never type them. Length matters far more than symbol variety: adding 4 lowercase letters adds more entropy than adding 2 symbols.
Is a passphrase really as strong as a random password?
Only if the words are chosen at random, which is what this tool does. Each word from a 400-word list is worth log2(400), about 8.6 bits, so a 6-word phrase is about 52 bits, comparable to a 9-character password from all four classes. The advantage is that you can actually remember it. Do not weaken it by picking words yourself or by using a famous quotation; attackers try common phrases first.
What does the crack-time estimate assume?
It assumes the attacker has a leaked hash of the password and can test 10 billion guesses per second, which is what a rig of a few modern GPUs achieves against a fast hash such as unsalted SHA-1 or NTLM. Against a properly slow hash (bcrypt, scrypt, Argon2) the real rate is thousands of times lower, and against an online login form it is lower still because of rate limiting. The figure is the time to try every possibility; on average an attacker succeeds in about half that.
Are the passwords generated here safe to use?
Yes, as far as generation goes: the page uses the browser's cryptographic random number generator, runs entirely on your device, and never transmits or stores anything. The remaining risks are the usual ones: reusing the password on more than one site, saving it somewhere insecure, or typing it into a phishing page. Store it in a password manager and enable two-factor authentication where available.