Free tool· Security & keys
Generate strong passwords and passphrases — privately, in your browser
Random passwords up to 128 characters, diceware passphrases from the EFF word lists and pronounceable passwords, with a live strength meter, bulk mode and downloads. Generated on your device; nothing is sent or stored.
- Runs in your browser
- Free, no signup
- Updated
Type
The strongest per character — best for a password manager to remember.
Options
Replaces the default symbol set — useful when a site only allows some symbols.
Your password
Entropy
130 bits
89 possible characters
Time to crack
longer than the age of the universe
at 100 billion guesses a second
Generate many
Up to 500 at once — each one independent.
About this tool
What is the Password Generator?
The Password Generator is a free tool that creates strong random passwords, diceware passphrases from the EFF word lists and pronounceable passwords in your browser, using crypto.getRandomValues. A live entropy meter shows how strong each one is, and bulk mode makes up to 500 at once.
- Price
- Free
- Signup
- None
- Your data
- Stays in your browser
- Updated
What you get
- Random passwords from 4 to 128 characters
- Diceware passphrases (EFF large and short word lists)
- Pronounceable passwords you can read aloud
- Exclude look-alike or hard-to-type characters
- Entropy meter and crack-time estimate
- Bulk mode: up to 500, as .txt or .csv
Security & keys · no account, nothing uploaded
How it works · three steps, no signup
How to use the Password Generator
Step 1: Pick a type
Random characters for a password manager, a passphrase you can type and remember, or a pronounceable password you can read out.
Step 2: Tune the rules
Set the length and character sets, leave out look-alike or hard-to-type characters, or add your own symbols to meet a site's policy.
Step 3: Copy or download
Copy the password, or generate up to 500 at once and download them as .txt or .csv — handy for provisioning test accounts.
Good to know
How this generator stays honest
Every character and word is chosen with crypto.getRandomValues and rejection sampling, so each option is exactly as likely as every other — a plain remainder operation would quietly favour some characters. Math.random, which is not designed for secrets, is never used.
The strength meter reports the entropy of how the password was made, not of how it looks. That is the number that matters: a random 12-character password is stronger than a 20-character phrase you chose yourself, because an attacker's guessing follows the way people pick passwords.
Passphrases use the Electronic Frontier Foundation's diceware word lists, published under the Creative Commons Attribution 3.0 US licence. Thank you to the EFF for making them freely available.
FAQ
Password Generator: questions and answers
Is it safe to generate a password on a website?
It is when the password never leaves your device, which is how this tool works: everything is generated in your browser with crypto.getRandomValues, the operating system's cryptographically secure random number generator. Nothing is sent to a server, logged or stored, and the page keeps no history. The share link only carries your settings, never a password.
How long should a password be?
For anything a password manager remembers, use at least 16 random characters from all four sets — about 105 bits of entropy, far beyond any brute-force attack. For a password you must type or remember, a passphrase of six or more random words is easier to handle and similarly strong. Short PINs are only safe where the system locks out repeated guesses.
What does entropy mean, and why does it matter?
Entropy measures how many guesses an attacker needs: every extra bit doubles the work. A password's entropy is its length multiplied by log₂ of the number of characters it is drawn from — so a 20-character password from 88 characters has about 129 bits. Entropy only holds if the password is truly random, which is why human-made passwords score far lower than they look.
What is a diceware passphrase?
A passphrase built from words picked at random from a fixed list, originally with dice. This tool uses the Electronic Frontier Foundation's word lists: 7,776 words (about 12.9 bits each) or 1,296 shorter words (about 10.3 bits each). Six words from the large list give about 77 bits — strong, and much easier to type than random symbols.
Why exclude look-alike or hard-to-type characters?
Characters like l, 1, I, O and 0 are easy to misread when a password is printed, read aloud or typed from a screen, and brackets, quotes and backslashes can break scripts, config files and some login forms. Excluding them shrinks the character pool slightly, so the tool recalculates the strength — add a couple of characters to compensate.
Still have questions?
Book a demoMore free tools
Keep your stack sharp
Ready to do this at scale?
InfiQ puts broadcasts, chatbots, a shared inbox and the developer API behind one dashboard — on the official WhatsApp Business API. 7-day free trial, no card required.