Password Generator
This free password generator creates strong, random passwords in your browser using secure cryptographic randomness. Choose the length and character types, or switch to passphrase mode for memorable random words. A strength meter shows the entropy in bits and how long the result would take to crack, and one click copies it.
Select at least one character type.
Time to crack by brute force: billions of years
How long should a password be?
At least 15 characters for any account that has only a password protecting it. That is the minimum in the 2025 revision of NIST's digital identity guidelines (SP 800-63B-4), which drops it to 8 only when a second factor, like a code from an app, is also required. The same guidelines tell sites to stop forcing mixtures of symbols and numbers, because length does far more than complexity.
This is what length buys, using the same model as the strength meter below, an offline attack at ten billion guesses per second:
| Password | Strength | Average time to crack |
|---|---|---|
| 8 characters, all four types | 51 bits | about a day |
| 12 characters, all four types | 77 bits | about 240,000 years |
| 16 characters, lowercase only | 75 bits | about 60,000 years |
| 16 characters, all four types | 103 bits | longer than the age of the universe |
Notice the third row: 16 lowercase letters beat 8 characters packed with symbols by a huge margin. The generator starts at 16 characters with every type switched on.
Is it safe to use an online password generator?
It is when the password is made on your device and never leaves it, which is how this one works. Each character is chosen with your browser's cryptographic random number generator, crypto.getRandomValues, the kind built for security keys, with the small correction that keeps some characters from coming up more often than others. Nothing is sent to a server or stored, and closing the tab erases it.
We checked the output instead of trusting the code. We generated 6,000 passwords of 16 characters with the default settings: none repeated, every one contained all four types you ask for, and each of the 86 characters appeared as often as the maths predicts, within the normal spread of chance. Digits show up a little more than letters, by design: every password is guaranteed at least one, and there are only ten of them.
How many words does a passphrase need?
More than most people think. A passphrase like pebble-Paddle-peach-willow-board-earth-cable-63 is easy to read out and type on a phone or a TV remote, and its strength comes from how many random words it has. Our word list has 330 short, common words, so each word adds 8.4 bits:
| Words, with a capital and a number | Strength | Average time to crack |
|---|---|---|
| 4 | 42 bits | minutes |
| 6 | 59 bits | about 11 months |
| 7 | 68 bits | several hundred years |
| 8 | 76 bits | over 100,000 years |
That is why Passphrase mode starts at seven words. Longer lists, like the 7,776-word Diceware list, give about 12.9 bits per word, so six of their words do what eight of ours do; the meter always shows the real strength of what you have. Use a passphrase for the few passwords you must type from memory, such as a password manager's master password.
How do the strength meter and crack time work?
The meter counts entropy in bits: the length multiplied by the base-2 logarithm of how many characters you allow, or for a passphrase, the number of words multiplied by the logarithm of the list size. Under 40 bits is weak, 40 to 59 fair, 60 to 79 strong and 80 or more excellent.
The time to crack assumes a fast offline attack of about ten billion guesses per second and that, on average, half of all possibilities are tried. It is a guide to the worst realistic case, not a promise: a password that has already leaked in a breach is guessed instantly, however long it is. So never reuse one, and keep them in a password manager rather than a notes file.
Frequently asked questions
Are the passwords really random and safe to use?
Yes. Each character comes from your browser's cryptographic random number generator, crypto.getRandomValues, built for security keys. We generated 6,000 passwords to check: none repeated, all had every type requested, and the character counts matched what pure chance predicts. The password is made on your device and never sent anywhere.
How long should my password be?
At least 15 characters when the password is the only thing protecting the account, which is the minimum in NIST’s 2025 guidelines, and 8 when a second factor is also required. This generator starts at 16. Length matters more than complexity: 16 lowercase letters are far stronger than 8 mixed characters.
What does 'avoid ambiguous characters' do?
It removes characters that look alike, such as the capital O and zero, or the lowercase L, capital I, and the number one. This makes a password easier to read and type by hand without weakening it much. Leave it off for maximum variety when you only copy and paste.
How is the strength rated?
The rating is based on entropy, a mathematical measure of how many guesses it would take to crack the password. It comes from the length multiplied by the size of the character set you chose. More length and more character types raise the entropy, moving the meter from weak toward excellent.
Should I reuse passwords or save them here?
Never reuse a password across accounts; if one site is breached, the rest stay safe only if each password is unique. This tool does not save anything, by design. Use a password manager to store the passwords you generate, so you do not have to remember them.
What is a passphrase, and is it stronger?
A passphrase strings random words together, like river-Orange-tiger-42, instead of scrambled characters. It is easier to remember and type, but each word from our 330-word list adds only 8.4 bits, so it needs about seven words to reach the strength of a random 12-character password. The meter shows exactly where you stand.
How long would it take to crack my password?
The tool estimates it from entropy, assuming a fast offline attack of ten billion guesses per second. Under 40 bits falls in under a minute. Around 60 bits holds out for a year or two, and 80 bits or more runs into millions of years, which is why length matters more than exotic symbols.
Can I generate a password I can actually remember?
Yes, switch to Passphrase mode. It builds a phrase from random common words with an optional capital letter and number, which is much easier to recall and type than a random string. For accounts you must type by hand, a longer passphrase beats a short scrambled password.
How many words should a passphrase have?
With this generator, seven words plus a number reach about 68 bits, which the meter rates strong, and eight words reach 76 bits. Six words stop at 59 bits. Lists with more words, like the 7,776-word Diceware list, need fewer words for the same strength, because each word carries more possibilities.
Related tools
Rate Password Generator & help shape it
This tool is free and still growing. Tell us what works, what you would change, and what is missing. Your feedback is what decides what we build next.
Built and tested by the ÆON Toolhub team. Last updated: October 19, 2026. How we test our tools