Password Generator

What makes a password strong?

A strong password is long and unpredictable. Length is the single biggest factor: each extra character multiplies the number of guesses an attacker would need. A random mix of character types helps too, but a long password always beats a short, clever one. This free password generator from ÆON Toolhub gives you both, and shows the resulting strength so you are not guessing.

Everything happens on your device. The password is built in your browser and never sent to a server, so it is genuinely private the moment it appears.

How do you use it?

Pick a mode. Password builds a random string of characters. Passphrase builds something you can actually remember, from random words.

Set the length. For everyday accounts, 16 characters is a solid baseline; for email, banking, or anything sensitive, go to 20 or more.

Choose the character types. Turn uppercase, lowercase, numbers, and symbols on or off. The more types you include, the larger the pool each character is drawn from.

Avoid look-alikes (optional). Skip characters that are easy to confuse, like the capital O and zero, or the lowercase L, capital I, and the number one. Useful when you will type the password by hand.

Copy it. One click copies the result. Use the refresh button to roll a new one anytime.

What is a passphrase, and when should you use one?

A passphrase is a handful of random words joined together, like river-Orange-tiger-42. It is far easier to remember and to type on a phone or a TV remote than a scrambled string, and it is still strong, because the strength comes from how many random words you use rather than from symbols.

Switch to Passphrase mode and you can set the number of words, the separator, whether one word is capitalized, and whether a number is added at the end. Each extra word adds meaningful entropy, so the meter climbs as you go. Use a passphrase for the few passwords you have to type by hand, like your device login or your password manager's master password.

Why does the randomness matter?

Not all random is equal. This tool uses your browser's cryptographic random number generator, crypto.getRandomValues, which is designed to be unpredictable even to an attacker who sees other outputs. Many weaker tools use Math.random, which is fast but predictable and never meant for security. It also corrects modulo bias, so every character and every word is equally likely.

How do the strength meter and crack time work?

The meter is based on entropy, measured in bits: the length multiplied by the base-2 logarithm of the pool size (for a passphrase, the word count multiplied by the log of the word list size). Roughly:

• Under 40 bits is weak and can be cracked quickly.
• 40 to 59 bits is fair.
• 60 to 79 bits is strong for most uses.
• 80 bits or more is excellent, well beyond practical brute force.

The "time to crack" line turns that number into something human, assuming a fast offline attack of about ten billion guesses per second and searching half the space on average. It is an estimate of the worst realistic case, not a promise, and it is exactly why adding length moves the needle far more than adding one more symbol.

How should you store passwords?

The best password is useless if you reuse it, and impossible if you cannot remember it. Generate a unique password for every account, and keep them in a password manager rather than in your head or a notes file. This tool never stores what it creates; once you close the tab, the result is gone.