Free Password Generator & Strength Checker
Also called a strong password generator, random password maker, passphrase generator, or password strength tester.
Create strong, random passwords and easy-to-remember passphrases in one click — then test any password’s strength, see how long it would take to crack, and check whether it has appeared in a data breach.
Generate in bulk
Recent (this tab only)
(100 guesses/hour)
(10 guesses/second)
(10 thousand/second)
(10 billion/second)
How to Create a Strong Password
Quick answer: A strong password is long, random and unique. Use at least 16 random characters — or a passphrase of 6 or more random words — never reuse it on another site, and store it in a password manager. The generator above does all of this in one click.
Choose a type
Random password for most accounts, passphrase for anything you type by hand, PIN for phones and cards.
Set the length
16+ characters for passwords, 6+ words for passphrases. Longer is always stronger.
Pick character types
Mix upper and lowercase, numbers and symbols — and remove any symbols a site won’t accept.
Copy & save
Use it for one account only and save it in a password manager so you never have to remember it.
A Password Generator You Can Actually Trust
Generating a password on a website only makes sense if that website never sees it. This tool runs entirely in your browser: passwords are created on your device, the strength checker analyses them on your device, and nothing is sent to our server, logged or stored.
It also uses the right kind of randomness. Instead of the predictable Math.random() function many simple generators rely on, it uses your browser’s cryptographically secure random number generator — the same source used for encryption keys — with unbiased sampling so every character is equally likely.
🔒 Local only
Passwords never leave your device — you can even disconnect from the internet and it still works.
🎲 Truly random
Built on crypto.getRandomValues(), not a predictable pseudo-random function.
🧠 Honest scoring
The checker spots common words, years, sequences and look-alike tricks instead of just counting symbols.
🕵️ Breach check
Find out if a password has leaked — without ever sending the password itself.
Everything in One Tool
🔐 Random passwords
4 to 128 characters with any mix of uppercase, lowercase, numbers and symbols.
📝 Passphrases
3 to 10 random words with your choice of separator, capitals and a number — strong and easy to type.
🔢 PIN generator
Random 4–12 digit PINs for phones, cards and door locks.
👀 Avoid look-alikes
Leave out I, l, 1, O, o and 0 for passwords you’ll read aloud or type from paper.
⚙️ Site-friendly options
Start with a letter, avoid repeats, or limit symbols to the ones a website allows.
📦 Bulk generation
Create up to 100 passwords at once — copy them all or download a .txt file.
📊 Strength meter
Five-level rating with entropy in bits so you can see exactly how strong a password is.
⏱️ Crack-time estimates
Four realistic attack scenarios, from a rate-limited login page to a GPU cracking rig.
💡 Improvement tips
Specific warnings and suggestions — like “contains a year” or “built around a common word”.
How Long Should a Password Be? Crack Times by Length
Every extra character multiplies the number of possible passwords. Here’s roughly how long it takes to crack a truly random password (upper, lower, numbers and symbols) at 10 billion guesses per second — a fast offline attack.
| Length | Entropy | Time to crack (fast offline attack) | Verdict |
|---|---|---|---|
| 6 characters | ~39 bits | Under a minute | Never use |
| 8 characters | ~52 bits | A few days | Too short |
| 10 characters | ~66 bits | Around 100 years | Borderline |
| 12 characters | ~79 bits | Hundreds of thousands of years | Good minimum |
| 16 characters | ~105 bits | Far longer than the age of the universe | Recommended |
| 20+ characters | ~131+ bits | Effectively uncrackable by brute force | Excellent |
These figures apply only to randomly generated passwords. A human-chosen password of the same length — like Summer2024! — can be cracked in minutes, because attackers try common words, names and patterns first.
Password vs. Passphrase
🔐 Random password
- Maximum strength in the fewest characters
- Perfect when a password manager fills it in for you
- Hard to remember or type on a phone
- Best for: websites, apps, banking, work accounts
📝 Passphrase
- Long, so it’s very strong — but easy to remember
- Quick to type, even on a TV remote or phone
- Words must be random — never a quote or song lyric
- Best for: password manager master password, laptop login, Wi-Fi
How the Password Strength Checker Works
Simple strength meters just check whether you used a capital letter and a symbol — which is why P@ssw0rd! often shows up as “strong”. Real attackers don’t guess randomly; they start with the most likely passwords. So this checker estimates how many guesses an attacker would actually need.
It looks at the length and variety of characters, then lowers the estimate for anything predictable: common passwords, dictionary words, look-alike swaps like @ for a, keyboard patterns like “qwerty”, sequences like “abc” or “123”, repeated characters, and years. The result is turned into four crack-time estimates:
Online, rate-limited
About 100 guesses per hour — a login page that locks or slows down after failed attempts.
Online, no limit
About 10 guesses per second against a poorly protected login.
Offline, slow hash
About 10,000 guesses per second after a breach, when the site stored passwords properly (e.g. bcrypt).
Offline, fast hash
About 10 billion guesses per second on GPUs, when passwords were stored with a weak hash.
All estimates are approximate. The checker can’t know your name, birthday or pet — a password containing personal details is weaker than it looks.
Check for Data Breaches Without Revealing Your Password
The breach check uses the free Have I Been Pwned password database, which contains hundreds of millions of passwords exposed in real data breaches. It uses a privacy technique called k-anonymity:
- Your browser turns the password into a SHA-1 hash — a one-way fingerprint.
- Only the first 5 characters of that hash are sent, which match hundreds of unrelated passwords.
- The matching list comes back and your browser checks it locally.
Your actual password never leaves your device, and the check only runs when you click the button.
Password Patterns Attackers Try First
123456 · password · qwertyThe most common passwords in every breach list — cracked instantly.
Word + number“monkey123”, “India2024” — the single most predictable pattern people use.
Look-alike swaps“P@ssw0rd”, “L0v3ly” — attackers’ tools test every common substitution automatically.
Names & datesYour name, a partner’s or pet’s name, birthdays and anniversaries are easy to find online.
Keyboard walks“asdfgh”, “1qaz2wsx”, “zxcvbn” look random but are in every cracking dictionary.
Reused passwordsOne breach exposes every account that shares the password — the cause of most account takeovers.
Password Security Checklist
Current guidance from security standards such as NIST SP 800-63B focuses on length, uniqueness and breach screening — not on forcing symbols or frequent changes.
- Use a unique password for every account — reuse is the biggest risk of all.
- Prefer length over complexity — 16 random characters or 6 random words.
- Use a password manager so you only need to remember one strong passphrase.
- Turn on two-factor authentication (2FA) — an authenticator app is better than SMS.
- Use passkeys where offered — they can’t be phished or reused.
- Change a password when it’s been breached, not on a fixed schedule.
- Never share passwords over email, chat or text messages.
- Check new passwords against breach lists before you use them.
Recommended Settings by Use
Your email can reset every other password — protect it the most.
Some banks restrict symbols or length — adjust the allowed symbols to match.
The one password you must remember — make it long and memorable.
You’ll type it on phones, TVs and guest devices.
Admin access deserves the strongest protection.
Safe only because devices limit wrong attempts.
Frequently Asked Questions
Is this password generator safe to use?
Yes. Passwords are generated in your browser with a cryptographically secure random number generator and are never sent to our server, logged or stored. You can even use it offline once the page has loaded.
What makes a password strong?
Length, randomness and uniqueness. A strong password has at least 12–16 random characters (or 6+ random words), doesn’t contain words, names, dates or patterns, and isn’t used on any other account.
How long should my password be?
At least 12 characters, and 16 or more for important accounts. For passphrases, use at least 6 random words. Length adds far more strength than extra symbols.
Is a passphrase better than a password?
A passphrase of 6+ truly random words is as strong as a long random password and much easier to remember and type. Use passphrases for passwords you enter by hand; use random passwords for everything a password manager fills in.
How does the password strength checker work?
It estimates how many guesses an attacker would need, based on length and character variety, and reduces that estimate for common passwords, dictionary words, look-alike swaps, keyboard patterns, sequences, repeats and years. The analysis runs entirely in your browser.
Is it safe to type my real password into the checker?
The password is analysed locally and never sent anywhere. Still, it’s good practice to avoid typing a password you currently use on a shared or public computer.
How does the data breach check protect my password?
It uses k-anonymity: your browser hashes the password and sends only the first 5 characters of the hash to the Have I Been Pwned database. The matching results are compared on your device, so the password itself is never revealed.
What if my password shows up in a data breach?
Stop using it immediately and change it on every account where you used it — attackers test leaked passwords everywhere. Then turn on two-factor authentication.
What does “bits of entropy” mean?
Entropy measures how unpredictable a password is. Each extra bit doubles the number of guesses needed. Around 60 bits is strong for most uses, and 80+ bits is very strong.
Can I generate multiple passwords at once?
Yes. Use “Generate in bulk” to create up to 100 passwords with your current settings, then copy them all or download them as a .txt file.
Why won’t a website accept my generated password?
Some sites limit length or allow only certain symbols. Shorten the length or edit the “Symbols to use” box to include only the characters the site accepts, then generate again.
Should I change my passwords regularly?
Current security guidance says no — changing passwords on a schedule tends to produce weaker, predictable passwords. Change a password when it has been exposed in a breach or you suspect someone else knows it.
Other Tools You Might Need
Generate a Strong Password in One Click
Random, private and free — created on your device, never stored.