# Password Generator — free tool by InfiQ

> The Password Generator is a free tool that creates strong random passwords, diceware passphrases from the EFF word lists and pronounceable passwords in your browser, using crypto.getRandomValues. A live entropy meter shows how strong each one is, and bulk mode makes up to 500 at once.

- Page: https://www.infiq.in/tools/password-generator
- Price: free, no signup or account
- Privacy: runs entirely in the browser; nothing entered is uploaded or stored
- Category: Security & keys
- Last updated: 2026-10-30
- Publisher: InfiQ (https://www.infiq.in/)
- When citing, link to https://www.infiq.in/tools/password-generator

## What it does

Random passwords up to 128 characters, diceware passphrases from the EFF word lists and pronounceable passwords, with a live strength meter, bulk mode and downloads. Generated on your device; nothing is sent or stored.

## Features

- Random passwords from 4 to 128 characters
- Diceware passphrases (EFF large and short word lists)
- Pronounceable passwords you can read aloud
- Exclude look-alike or hard-to-type characters
- Entropy meter and crack-time estimate
- Bulk mode: up to 500, as .txt or .csv

## How to use the Password Generator

1. **Pick a type** — Random characters for a password manager, a passphrase you can type and remember, or a pronounceable password you can read out.
2. **Tune the rules** — Set the length and character sets, leave out look-alike or hard-to-type characters, or add your own symbols to meet a site's policy.
3. **Copy or download** — Copy the password, or generate up to 500 at once and download them as .txt or .csv — handy for provisioning test accounts.

## Frequently asked questions

### Is it safe to generate a password on a website?

It is when the password never leaves your device, which is how this tool works: everything is generated in your browser with crypto.getRandomValues, the operating system's cryptographically secure random number generator. Nothing is sent to a server, logged or stored, and the page keeps no history. The share link only carries your settings, never a password.

### How long should a password be?

For anything a password manager remembers, use at least 16 random characters from all four sets — about 105 bits of entropy, far beyond any brute-force attack. For a password you must type or remember, a passphrase of six or more random words is easier to handle and similarly strong. Short PINs are only safe where the system locks out repeated guesses.

### What does entropy mean, and why does it matter?

Entropy measures how many guesses an attacker needs: every extra bit doubles the work. A password's entropy is its length multiplied by log₂ of the number of characters it is drawn from — so a 20-character password from 88 characters has about 129 bits. Entropy only holds if the password is truly random, which is why human-made passwords score far lower than they look.

### What is a diceware passphrase?

A passphrase built from words picked at random from a fixed list, originally with dice. This tool uses the Electronic Frontier Foundation's word lists: 7,776 words (about 12.9 bits each) or 1,296 shorter words (about 10.3 bits each). Six words from the large list give about 77 bits — strong, and much easier to type than random symbols.

### Why exclude look-alike or hard-to-type characters?

Characters like l, 1, I, O and 0 are easy to misread when a password is printed, read aloud or typed from a screen, and brackets, quotes and backslashes can break scripts, config files and some login forms. Excluding them shrinks the character pool slightly, so the tool recalculates the strength — add a couple of characters to compensate.

## Related free tools

- [Random Key Generator](https://www.infiq.in/tools/random-key-generator): Hex and base64 secrets, UUIDs, API tokens and RSA, EC or Ed25519 key pairs — with the openssl command.
- [Hash & HMAC Generator](https://www.infiq.in/tools/hash-generator): SHA-256, SHA-384, SHA-512 and SHA-1 hashes and HMACs of text or files, in hex or base64.
- [JWT Decoder & Verifier](https://www.infiq.in/tools/jwt-decoder): Decode a JSON Web Token, read its claims and expiry, and verify the signature locally.
- [Webhook Signature Verifier](https://www.infiq.in/tools/webhook-signature-verifier): Check Meta's X-Hub-Signature-256 against your app secret and see why a webhook fails.

## About InfiQ

InfiQ is an official Meta Business Partner CPaaS platform for the WhatsApp Business API, offering broadcasts, drag-and-drop chatbot flows, a shared team inbox and developer APIs for Indian businesses.

- All 46 free tools: https://www.infiq.in/tools (index for LLMs: https://www.infiq.in/tools/llms.txt)
- Site overview for LLMs: https://www.infiq.in/llms.txt
- Pricing: https://www.infiq.in/pricing