SysAdmin Tools

Password Generator

Generate strong, secure passwords and passphrases — entirely in your browser. Your password is never sent over the network or stored anywhere.

Generated entirely in your browser using the Web Crypto API. Your password is never sent over the network, logged, or stored anywhere — not even temporarily.

Generating…

Password StrengthStrong

103 bits of entropy

16
864

Character Types

Bulk Generation

Click the button to generate 5 passwords using your current settings.

Security Tips

Use a unique password for every account

Reusing passwords means a single breach compromises every account that shares it. A password manager makes it practical to use unique credentials everywhere.

Use a password manager to store credentials

Tools like Bitwarden, 1Password, and KeePassXC encrypt your credentials locally or in the cloud. You only need to remember one strong master password.

Enable two-factor authentication wherever possible

Even if an attacker obtains your password, 2FA blocks access without the second factor. Enable it on every account that supports it — email and banking accounts first.

Avoid reusing passwords across multiple sites

Credential stuffing attacks test leaked username/password pairs against every major service automatically. Unique passwords make these attacks useless against you.

Advertisement

A password generator creates cryptographically random passwords and passphrases that are far more secure than anything a human would choose. We are terrible at inventing random strings — we reach for familiar words, keyboard patterns, and dictionary terms that attackers anticipate. A secure password generator eliminates that bias entirely by drawing on the browser's built-in cryptographic random number source, the Web Crypto API.

This tool runs entirely in your browser. No data leaves your device, no password is transmitted over the network, and nothing is stored in logs or databases — not even temporarily. You can verify this by disconnecting from the internet and confirming the generator still works.

The generator offers two modes. Character Password mode builds a string from a configurable mix of uppercase letters, lowercase letters, digits, and symbols, at any length from 8 to 64 characters. A real-time strength meter shows entropy in bits so you can immediately see the mathematical impact of each setting. Passphrase mode selects random words from a curated wordlist and joins them with a separator of your choice. Passphrases trade character-set diversity for length, achieving strong entropy while producing something a human can actually remember and type.

Whatever mode you choose, the output is generated using crypto.getRandomValues() — the same API used by browser-based cryptography libraries — with rejection sampling to eliminate modulo bias. This is categorically different from Math.random(), which is not a cryptographic source and must never be used for security-sensitive applications.

How to Use the Password Generator

  1. 1

    Choose a mode

    Select "Character Password" for a traditional random string, or "Passphrase" for a sequence of random words. Both are generated locally in your browser the moment you load the page.

  2. 2

    Adjust the settings

    For character passwords, drag the length slider and toggle character types on or off. The entropy meter and strength label update instantly as you change settings. For passphrases, set the word count, choose a separator, and toggle capitalisation and number appending.

  3. 3

    Read the strength meter

    The entropy value in bits tells you the mathematical strength of the generated password. Aim for at least 60 bits for personal accounts and 80+ bits for anything sensitive. Each additional character or character type multiplies the search space exponentially.

  4. 4

    Copy your password

    Click the Copy button to write the password directly to your clipboard without displaying it anywhere else. Use the Regenerate button to produce a fresh password with the same settings without changing any options.

  5. 5

    Generate a batch if needed

    Click "Generate 5 more" to produce five additional passwords using your current settings. Each one is independently generated with cryptographic randomness — they are not derived from or related to each other.

Understanding Password Strength

Password strength is measured in entropy bits — a value calculated as length × log₂(character set size). Entropy describes how many guesses an attacker would need to try, on average, to crack the password by brute force. Each additional bit of entropy doubles the search space: 60 bits requires roughly a quintillion guesses; 80 bits requires about a million times more than that. The two levers that control entropy are length and character set size. A 12-character password using only lowercase letters draws from a pool of 26, giving 56 bits of entropy. Adding uppercase, numbers, and symbols expands the pool to 95 characters and raises entropy to 79 bits at the same length. Increasing to 16 characters pushes it to 105 bits. This is why both length and character diversity matter — but length has the larger compounding effect. A passphrase like Frost-River-Anvil-Dawn-47 achieves strong entropy through length rather than character complexity. With a wordlist of 500 words and four words selected, the phrase has roughly 45 bits from the words alone, but it is far more typeable and memorable than an equally long random character string. Adding capitalisation and a digit improves it further and satisfies common password-policy requirements. The Exclude Ambiguous Characters option removes characters that look alike in some fonts — 0 and O, 1 and l and I — reducing transcription errors when you must type a password by hand. This slightly reduces the character set size and therefore entropy, but the trade-off is usually worth it for passwords that must be entered manually.
FieldDescription
Entropy (bits)The mathematical measure of unpredictability: length × log₂(pool size). Every additional bit doubles the number of guesses an attacker needs.
Pool SizeTotal number of distinct characters available at each position. Uppercase (26) + lowercase (26) + numbers (10) + symbols (33) = 95 printable ASCII characters.
LengthNumber of characters in the password. Has a compounding effect on entropy — each additional character multiplies the search space by the pool size.
PassphraseA sequence of randomly selected dictionary words joined by a separator. Entropy is determined by wordlist size and word count rather than character set.
Rejection SamplingThe technique used internally to avoid modulo bias when mapping a random number onto a character pool. Ensures every character has a perfectly equal probability of selection.

Advertisement

Common Use Cases

Creating an account on a new service

Generate a unique 16+ character password with all character types enabled. Store it immediately in your password manager so you never need to remember it — just copy and paste when you log in.

Replacing a weak or reused password

If a service you use has been involved in a data breach, generate a new password here, update the account, and confirm the new password is saved in your manager before closing the tab.

Creating a memorable master password

Use Passphrase mode to generate a 4–6 word phrase. Master passwords for password managers and encrypted drives need to be both strong and memorisable — passphrases achieve both better than random character strings.

Meeting strict password-policy requirements

Enable all four character types to satisfy policies that require uppercase, lowercase, digits, and symbols. The strength meter confirms compliance at a glance. Use the Exclude Ambiguous option if you must type the password by hand.

Password Generator — Frequently Asked Questions

What makes a password strong?
A strong password has high entropy — meaning an attacker would need an enormous number of guesses to crack it by brute force. Entropy is determined by two factors: the length of the password and the size of the character set it draws from. A 16-character password using uppercase letters, lowercase letters, numbers, and symbols has around 105 bits of entropy, which is computationally infeasible to crack with any hardware available today. Predictability is the other axis: even a long password is weak if it follows a pattern an attacker can anticipate, such as a dictionary word with a number appended.
How long should a password be?
For general online accounts, 12–16 characters is a solid minimum when all character types are enabled. For anything particularly sensitive — email, banking, your password manager master password — use 20+ characters or a 4–6 word passphrase. Length is the single most impactful variable: each additional character multiplies the brute-force search space by the size of the character pool. The National Institute of Standards and Technology (NIST) no longer mandates complexity requirements but does recommend passwords of at least 15 characters for memorised secrets.
What is password entropy and why does it matter?
Entropy is a measurement of unpredictability expressed in bits. For a randomly generated password, entropy = length × log₂(character pool size). Each bit of entropy doubles the number of guesses an attacker needs on average. At 60 bits, a brute-force attack requires around a quintillion guesses — well beyond the reach of today's hardware in any reasonable timeframe. At 80 bits, it's roughly a million times harder again. Entropy matters because it gives you a single number that captures both length and character diversity, letting you compare passwords objectively rather than relying on subjective strength labels.
Should I use symbols in my passwords?
Yes, when the site allows it. Adding symbols expands the character pool from 62 (letters plus digits) to 95 (all printable ASCII), which adds about 0.7 bits of entropy per character — roughly equivalent to making the password one character longer for each four characters you have. The practical trade-off is that some sites reject certain symbols, and symbols are harder to type on mobile keyboards. If a site does not allow symbols, compensate with extra length: a 20-character alphanumeric password is still very strong.
Is a passphrase more secure than a random password?
It depends on the comparison. A four-word passphrase drawn from a 500-word list has about 45 bits of entropy from the word selection alone — less than a 12-character fully random password. However, passphrases are far more memorable, which means people are more willing to use longer ones. A five-word passphrase with capitalisation and an appended number achieves over 60 bits of entropy while being genuinely typeable. For master passwords and disk encryption passphrases — where you must actually remember and type the credential — a long passphrase is often the better practical choice.
How often should I change my passwords?
Modern security guidance, including NIST SP 800-63B, recommends against mandatory periodic password changes unless there is evidence of a breach. Forced rotation tends to encourage weaker passwords (users append a number or month and increment it), and it creates unnecessary work without a proportionate security benefit. The current best practice is to use strong, unique passwords — generated by a tool like this one — and change a password only when you have reason to believe it may be compromised. Monitor services like Have I Been Pwned to catch breaches early.
Is it safe to use an online password generator?
This generator is safe because it runs entirely in your browser. All password generation happens in JavaScript using the browser's Web Crypto API — your password is computed locally and never transmitted over the network. You can verify this by opening your browser's network inspector: no outgoing requests are made when you generate a password. The source code is transparent and can be inspected. For maximum peace of mind, you can also disconnect your internet connection before generating, and the tool will continue working identically, confirming it has no network dependency.
What are the most common password mistakes?
The most common mistakes are using dictionary words or proper nouns (vulnerable to dictionary attacks), substituting letters with similar-looking digits like 3 for E or 0 for O (attackers test these variations automatically), reusing passwords across sites (one breach exposes all accounts), using personal information like birthdays or names (guessable through social engineering), and using short passwords of eight characters or fewer (crackable with modern GPU-based brute-force tools in hours). All of these are eliminated by generating a truly random password and storing it in a password manager.
Should I reuse passwords across different sites?
No — reusing passwords is one of the most dangerous habits in online security. When a site is breached and its credential database leaked, attackers immediately run "credential stuffing" attacks: they test the leaked username and password combinations against every other major service automatically. If your email provider, bank, and streaming service all share the same password, a breach at the weakest of them compromises all three. The solution is to use a unique, randomly generated password for every account. A password manager makes this practical — you only need to remember one strong master password.
Do I need a password manager?
A password manager is strongly recommended for anyone who uses more than a handful of online accounts. Without one, the only realistic way to use strong unique passwords everywhere is to write them down or memorise them — both of which create their own security risks. A good password manager, such as Bitwarden (open-source and free), 1Password, or KeePassXC (offline), generates, stores, and auto-fills your credentials securely behind a single master password. The master password should be a strong passphrase you can actually memorise. Your password manager becomes the one credential you protect most carefully, and it handles everything else.

Related Tools

SSL Checker

Verify the HTTPS certificate of sites you store credentials for.

Security Headers

Audit whether a site enforces secure transport before trusting it with a password.

DKIM Lookup

Verify email authentication to reduce the risk of phishing attacks targeting your accounts.