Free Password Generator & Strength Checker
Create random passwords and passphrases, then test any password against the patterns attackers try first. Everything runs in your browser.
- Runs in your browser
- Web Crypto randomness
- No sign-up
–
Character types are here for sites that demand them. For strength, length and randomness matter more than any mix of symbols.
More options
Remove any symbol a site won't accept.
Shortcuts: G new password, C copy
- Passwords you copy appear here until you close or reload this tab.
–
Words come from the EFF long word list (7,776 words). Each random word adds about 12.9 bits of strength.
Checked on this device, up to 128 characters. Nothing you type here is sent anywhere unless you press "Check known breaches", which sends only a 5-character hash prefix.
–
- Guessing through a website login (100 tries an hour)
- –
- From a stolen database, slow hash (10,000 a second)
- –
- From a stolen database, fast hash (10 billion a second)
- –
What we found
How to make it stronger
Want to know if this password has leaked? The check sends only the first 5 characters of its SHA-1 hash to Have I Been Pwned. The password itself never leaves this device.
How this password generator works
Made on your device
Characters are picked with crypto.getRandomValues(), the browser's cryptographically secure random source, using rejection sampling to avoid bias. When every type must appear, passwords that miss one are thrown away and redrawn, so each valid password is equally likely.
Kept only in this tab
Your passwords are never saved on our servers or in your browser. The list of passwords you copied lives in memory and disappears when you close or reload the page.
Checked the way attackers guess
The checker uses zxcvbn-ts to find common passwords, dictionary words, names, dates, keyboard runs and look-alike swaps before it estimates a crack time.
Check it yourself. Open your browser's developer tools (F12), choose the Network tab and generate a few passwords. Generating makes no network requests at all. The Passphrase and Check strength tabs download a word list and password dictionaries from jsDelivr the first time you open them, and the breach check contacts Have I Been Pwned only when you press it. Your passwords are never part of any request.
Password problems this tool fixes
Find the problem you ran into. Each fix sets up the generator for you in one click.
| Your problem | How this tool fixes it | Fix |
|---|---|---|
| The site won't accept my password | ||
| "This password is not allowed" after I typed a strong password | Most sites reject one or two symbols without saying which. Open More options and delete the symbols the site doesn't like from Allowed symbols. Every new password then uses only what's left. | |
| My bank, UPI or government portal keeps rejecting it | The Simple symbols preset makes 16 characters and limits symbols to @ # $ _, a small set that strict sites accept more often. If a site still refuses, remove the symbol it names from Allowed symbols. | |
| The site allows only letters and numbers | Symbols are switched off and the length goes up to 20, so the password stays just as hard to guess without them. | |
| "Password must be 8 to 12 characters" | Type the site's maximum into the Length box. With all four character types, even 12 characters holds out for centuries against fast offline guessing. | |
| "Must include an uppercase letter, a number and a symbol" | Use every selected type at least once is on by default, so every password already includes each type you've turned on and passes these rules first time. | |
| The app wants a numeric PIN | The PIN preset picks 6 random digits instead of predictable choices such as birthdays or years. | |
| The password is hard to use | ||
| I have to type it on a TV, game console or someone else's phone | Easy to type uses letters only, skips look-alikes and makes it 20 characters long, so there's no hunting for symbols on an on-screen keyboard. | |
| Guests keep typing our Wi-Fi password wrong | The Wi-Fi preset makes 20 letters and numbers with no look-alikes. That sits well inside the 8 to 63 characters WPA2 and WPA3 networks use for passphrases. | |
| I mix up 0 and O, or l, I and 1 | Turn on Skip look-alike characters and those eight characters never appear. | |
| I need one I can actually remember | Make a passphrase of six random words, such as the master password for your password manager or your laptop login. | |
| I'm worried about my password | ||
| I got a breach alert, or I'm not sure my password is safe | Paste it into Check strength to see how it would be cracked, then press Check known breaches. If it has leaked, make a new one and change it everywhere you used it. | |
| I'm setting up accounts for a team or a new device | Make 10 at once creates ten passwords with the same settings, ready to copy into your password manager. | |
How we calculate password strength
Random passwords made by this tool are measured in bits of entropy: the number of equally likely possibilities, written as a power of two.
bits = length × log₂(characters to choose from)
16 × log₂(90) ≈ 104 bits
With all four types on, there are 90 characters to choose from, and each extra character multiplies the work for an attacker by 90. In plain terms: every character you add makes a random password far harder to guess.
Requiring every type to appear removes the few passwords that would miss one. The tool subtracts that exactly, so the bits it shows are the true figure for your settings: 103.6 bits for the default 16 characters.
Passwords people make up aren't random, so bit counts overstate them. For these, the checker uses zxcvbn-ts to estimate how many guesses a cracking tool would need once it tries common passwords, words, names, dates and patterns first. It then divides that number by three attack speeds, shown in the checker: a rate-limited website login, a stolen database protected by a slow hash such as bcrypt, and one protected by a fast hash.
These are estimates, not promises. A password that has already leaked is weak whatever its score, which is why the breach check exists.
Sources: NIST SP 800-63B, EFF dice-generated passphrases, zxcvbn-ts, Have I Been Pwned: Pwned Passwords.
Passwords that look strong but aren't
Each of these would pass a typical "must contain a symbol" rule. Try them in the checker to see how quickly they fall.
Look-alike swaps. Cracking tools swap @ for a, 5 for s and 0 for o automatically, so this is still two dictionary words.
Season, year, exclamation mark. One of the most common patterns, and exactly what scheduled password changes produce.
Keyboard run plus a sequence. Both patterns are common in password dictionaries built from real breaches.
A famous example. Anything published as an example password ends up in cracking lists. Make your own random passphrase instead.
Password habits that actually matter
Do
- Use a different password for every account, so one leak can't unlock the rest.
- Let a password manager remember them, such as Bitwarden, 1Password, KeePassXC or the one built into your phone.
- Sign in with a passkey wherever a site offers one.
- Turn on two-step verification, preferably a passkey or an authenticator app rather than SMS codes.
- Change a password right away when a site reports a breach.
Avoid
- Names, birthdays, phone numbers and years.
- Look-alike swaps such as @ for a or 0 for o.
- Changing passwords on a schedule when nothing has leaked.
- Keeping passwords in notes apps, spreadsheets or chat messages.
- Reusing a password with a small change, like adding 1 or !.
Frequently asked questions
Short answers about privacy, length, passphrases and how the checker works.
Is this password generator safe to use?
Yes. Passwords are created in your browser with the Web Crypto API (crypto.getRandomValues), which is built for cryptographic use. Nothing you generate or check is sent to our servers. Passwords you copy are listed only in this tab and disappear when you close or reload it.
Does this tool save or send my passwords?
No. Generating and checking happen entirely on your device, and nothing you type or generate is sent to us. Your browser only downloads the passphrase word list and password dictionaries from jsDelivr when you first open those tabs. If you press the optional breach check, it sends the first five characters of your password's SHA-1 hash to Have I Been Pwned, never the password itself. The tool does remember your light or dark theme choice in your browser.
How long should my password be?
For a random password stored in a password manager, use at least 16 characters. For a password you must remember, such as your password manager's master password, use a passphrase of six or more random words. Adding length does more than adding symbols to a short password.
What is the difference between a password and a passphrase?
A password is a random string of characters, such as vH4pQz9TmR2wXk7n. A passphrase is a string of random words, such as lantern-oxide-marble-wagon-tulip-crisp. Both are strong when chosen at random. Passphrases are easier to type and remember, so they suit the few passwords you need to know by heart.
How is the crack time calculated?
The checker estimates how many guesses an attacker would need, using zxcvbn-ts to spot dictionary words, names, dates, keyboard patterns and look-alike swaps. It divides that number by three attack speeds: 100 guesses per hour against a rate-limited login, 10,000 per second against a stolen database with a slow hash, and 10 billion per second against one with a fast hash. These are estimates, not guarantees.
Should I change my passwords regularly?
Not on a fixed schedule. NIST guidance (SP 800-63B) says to change a password when there is evidence it was exposed, such as a breach notice, rather than every few months. Scheduled changes tend to produce predictable variations, like Summer2025! becoming Summer2026!.
Should I use a passkey instead of a password?
Yes, when a site offers one. A passkey signs you in with your device's screen lock or your password manager, and it only works on the site it was created for, so a fake login page can't capture it. Keep a strong, unique password for accounts that do not support passkeys yet.