- Free, no sign-up
- Generated on your device
- Private breach check
Free Password Generator & Strength Checker
Create strong passwords, passphrases and PINs, or test the one you use now: strength, crack time and a private breach check. All in your browser.
0.0 0 ratings
Generate in bulk
Recent (this tab only)
(100 guesses/hour)
(10 guesses/second)
(10 thousand/second)
(10 billion/second)
How useful was this tool?
Be the first to rate it.
How to use it
How to create a strong password
Quick answer: a strong password is long, random and unique. Use at least 16 random characters, or a passphrase of 7 or more random words, never reuse it, and keep it in a password manager. The generator above does the first part in one click.
Choose a type
Password for most accounts, especially anything a password manager fills in. Passphrase for what you type by hand. PIN for a phone or card.
Set the length
16 characters or more for passwords, 7 words or more for passphrases. Longer is always stronger, and the bits shown under the result tell you exactly how much.
Pick character types
Mix uppercase, lowercase, numbers and symbols, and remove any symbols a site will not accept. A new password appears with every change.
Copy and save
Click Copy, paste it into the sign-up form, and save it in your password manager straight away. Use it for this one account only.
Built forEveryday accountsPassword manager usersWi-Fi and home devicesIT and adminsDevelopersSmall teams
Why this tool
A password generator you can trust
Making a password on a website only makes sense if that website never sees it. This tool runs entirely in your browser. Passwords are created on your device, the strength checker analyses them on your device, and nothing is sent to our server, logged or stored. The only thing that ever leaves your browser is the 5-character hash prefix for the breach check, and only when you click that button.
It also uses the right kind of randomness. Many simple generators use Math.random(), which is predictable and was never meant for secrets. This one uses your browser's cryptographically secure random generator (crypto.getRandomValues()), the same source used for encryption keys, with unbiased sampling so every allowed character is equally likely.
Local only
Passwords never leave your device. Once the page has loaded, the generator and checker keep working even if you go offline.
Truly random
Built on crypto.getRandomValues(), not a pseudo-random function an attacker could predict.
Honest scoring
The checker spots common passwords, dictionary words, years, sequences and look-alike tricks instead of just counting symbols.
Breach check
Find out if a password has leaked in a data breach without ever sending the password itself.
Features
Everything in one tool
Make a new password, or test one you already have, without either leaving your device.
Random passwords
4 to 128 characters with any mix of uppercase, lowercase, numbers and symbols. Tick Use every selected type to make sure each one appears.
Passphrases
3 to 10 random words with a hyphen, dot, underscore, space, random number or no separator, plus optional capitals and a number on the end.
PIN generator
Random 4 to 12 digit PINs for phones, cards and door locks.
Avoid look-alikes
Leave out I, l, 1, O, o and 0 for passwords you will read aloud or type from paper.
Site-friendly options
Start with a letter, avoid repeated characters, or edit Symbols to use so only the symbols a website allows are picked.
Bulk generation
Create up to 100 passwords at once with your current settings, then copy them all or download a .txt file.
Strength meter
A five-level rating (Very weak to Very strong) with the entropy in bits, so you can see exactly how strong a result is.
Crack-time estimates
Four realistic attack scenarios, from a rate-limited login page to a GPU cracking rig.
Improvement tips
Specific warnings like "contains a year" or "built around a single common word", plus a checklist and tips to fix them.
Recent list
Passwords you generate stay in a Recent list for this tab only, in case you need the previous one. Close the tab and they are gone. Clear empties it at once.
Length matters most
How long should a password be?
Every extra random character multiplies the number of possible passwords. The table shows roughly how long a fast offline attack (10 billion guesses a second on GPUs) needs, on average, to find a truly random password made with the generator's default settings: uppercase, lowercase, numbers and the 24 default symbols, 86 characters in all.
| Length | Entropy | Average time to crack (fast offline attack) | Verdict |
|---|---|---|---|
| 6 characters | ~39 bits | About 20 seconds | Never use |
| 8 characters | ~51 bits | About 2 days | Too short |
| 10 characters | ~64 bits | About 35 years | Borderline |
| 12 characters | ~77 bits | Hundreds of thousands of years | Good minimum |
| 16 characters | ~103 bits | Far longer than the age of the universe | Recommended |
| 20+ characters | ~128+ bits | Out of reach of brute force | Excellent |
These figures only hold for randomly generated passwords. A human-made password of the same length, like Summer2024!, can fall in minutes, because attackers try common words, names and patterns first. Paste one into the checker and you will see the difference.
And passphrases?
The passphrase word list has 567 words, so each random word adds about 9 bits. That is why we suggest 7 words or more rather than 6.
| Passphrase | Entropy | Fast offline attack | Slow hash (bcrypt, 10,000/s) |
|---|---|---|---|
| 6 words, hyphens | ~55 bits | About 3 weeks | Tens of thousands of years |
| 7 words, hyphens | ~64 bits | About 30 years | Millions of years |
| 6 words, Random number separator | ~71 bits | Thousands of years | Effectively never |
| 8 words, hyphens | ~73 bits | Over 15,000 years | Effectively never |
Capitalize words does not add strength on its own, because every word is capitalised the same way. Add a number adds about 6 bits.
Which to use
Password vs passphrase
Random password
k#Vq8mT!zR2wL$x9
- The most strength in the fewest characters.
- Perfect when a password manager fills it in for you.
- Hard to remember, and slow to type on a phone.
- Best for: websites, apps, banking and work accounts.
Passphrase
maple-otter-violin-harbor-quiet-ember-lotus
- Long, so it is strong, yet easy to remember.
- Quick to type, even on a TV remote or phone.
- The words must be random: never a quote, song line or saying.
- Best for: your password manager's master password, laptop login and Wi-Fi.
Under the hood
How the strength checker works
Simple strength meters only check for a capital letter and a symbol, which is why P@ssw0rd! often shows as "strong". Real attackers do not guess randomly. They start with the most likely passwords. So this checker estimates how many guesses an attacker would actually need.
It starts from the length and the variety of characters, then lowers the estimate for anything predictable: common passwords, dictionary words, look-alike swaps like @ for a or 0 for o, keyboard runs like qwerty, sequences like abc or 123, repeated characters, and years. You also get a checklist: at least 12 characters, upper and lowercase, a number, a symbol, not a common password, no repeats or sequences, and no years or dates. The estimate is turned into four crack times:
Online, rate-limited
About 100 guesses an hour: a login page that locks or slows down after failed attempts.
Online, no limit
About 10 guesses a second against a poorly protected login.
Offline, slow hash
About 10,000 guesses a second after a breach, when the site stored passwords properly (for example with bcrypt).
Offline, fast hash
About 10 billion guesses a second on GPUs, when passwords were stored with a weak, fast hash.
All estimates are approximate and show the average time, not the worst case. The checker cannot know your name, birthday or pet, so a password that contains personal details is weaker than it looks. Click Check strength on a generated password to send it straight to the checker.
Breach check
Check for breaches without revealing it
The breach check uses the free Have I Been Pwned Pwned Passwords database, which holds hundreds of millions of real passwords exposed in data breaches. It uses a privacy technique called k-anonymity:
Your browser hashes it
The password is turned into a SHA-1 hash, a one-way fingerprint, on your device.
Only 5 characters are sent
Just the first 5 characters of that hash go to Have I Been Pwned. Hundreds of unrelated passwords share that prefix, and the request asks for padding so even the reply size gives nothing away.
The match happens locally
The list of matching hashes comes back and your browser checks it. You see whether, and how often, the password has appeared in breaches.
Your password and its full hash never leave your device, and the check only runs when you click the button. It needs an internet connection; everything else on the page does not.
Avoid these
Patterns attackers try first
Cracking tools do not guess letter by letter. They start with what people usually pick.
123456, password, qwerty
The most common passwords in every breach list. They are cracked instantly, and the checker says so.
A word plus a number
monkey123, India2024 or Rahul123 look long enough but are the single most predictable pattern people use.
Look-alike swaps
P@ssw0rd and L0v3ly fool weak meters, not attackers. Cracking tools test every common substitution automatically.
Names and dates
Your name, a partner's or pet's name, birthdays and anniversaries are easy to find on social profiles.
Keyboard walks
asdfgh, 1qaz2wsx and zxcvbn look random but sit in every cracking dictionary.
Reused passwords
When one site leaks, attackers try the same email and password everywhere else. This is behind most account takeovers. One account, one password.
Best practices
Password security checklist
Current guidance, such as NIST SP 800-63B, focuses on length, uniqueness and breach screening, not on forced symbols or regular changes.
- Use a unique password for every account. Reuse is the biggest risk of all.
- Prefer length over complexity: 16 random characters, or 7 or more random words.
- Use a password manager, so you only need to remember one strong passphrase.
- Turn on two-factor authentication (2FA). An authenticator app is better than SMS.
- Use passkeys where a site offers them. They cannot be phished or reused.
- Change a password when it has been breached, not on a fixed schedule.
- Never share passwords over email, chat or text messages.
- Check new passwords against breach lists before you use them.
Recommended settings
Recommended settings by use
One size does not fit all. Use these as a starting point.
Email and social media
Your email can reset every other password, so protect it most. Use: Password, 20 characters, all types, plus 2FA.
Banking and UPI apps
Some banks limit length or symbols, so adjust Symbols to use to match. Use: Password, 16 characters or more, plus 2FA.
Password manager
The one password you must remember, so make it long and memorable. Use: Passphrase, 8 words, or 7 words with the Random number separator.
Wi-Fi network
You will type it on phones, TVs and guest devices. Use: Passphrase, 7 words, or a 16+ character password with Avoid look-alikes on.
Work and admin accounts
Admin access deserves the strongest protection. Use: Password, 24 characters or more, plus a hardware key or passkey.
Phone and card PIN
Safe only because the device limits wrong attempts. Use: PIN, 6 digits or more. Never 123456 or your birth year.
Why it matters
Why random beats clever
Length wins
Each extra random character multiplies the guesses needed. A random 16 character password is far stronger than a short one full of symbols.
Humans are predictable
The passwords we invent follow patterns, and attackers model those patterns. A computer's random pick has none.
Private by design
A generator that runs on a server could see your password. This one runs in your browser.
FAQ
Frequently asked questions
Is this password generator safe to use?
Yes. Passwords are created in your browser with its cryptographically secure random generator and are never sent to our server, logged or stored. The Recent list lives in the page only and is gone when you close the tab. You can even use the generator offline once the page has loaded.
What makes a password strong?
Length, randomness and uniqueness. A strong password has at least 12 to 16 random characters (or 7 or more random words), contains no words, names, dates or patterns, and is not used on any other account.
How long should my password be?
At least 12 characters, and 16 or more for email, banking and admin accounts. For a passphrase, use at least 7 random words. Extra length adds more strength than extra symbols.
Is a passphrase better than a password?
A passphrase of 7 or more truly random words is strong and much easier to remember and type than a random password, though it needs more characters for the same strength. Use passphrases for what you type by hand and random passwords for what your password manager fills in.
How does the password strength checker work?
It estimates how many guesses an attacker would need from the length and character mix, then lowers that for common passwords, dictionary words, look-alike swaps, keyboard runs, sequences, repeats and years. It runs in your browser. It cannot know personal details like your name, so a password that contains them is weaker than the score suggests.
Is it safe to type my real password into the checker?
It is analysed on your device and never sent anywhere (the breach check sends only a 5-character hash prefix, and only when you click). Still, avoid typing a password you use now on a shared or public computer.
How does the data breach check protect my password?
It uses k-anonymity. Your browser turns the password into a SHA-1 hash and sends only the first 5 characters of it to Have I Been Pwned. Every leaked hash that starts the same way comes back, and the match is made on your device. Your password and its full hash never leave your browser.
What if my password shows up in a data breach?
Stop using it. Change it on every account where you used it, starting with email and banking, because attackers test leaked passwords everywhere. Then turn on two-factor authentication.
What does "bits of entropy" mean?
Entropy measures how unpredictable a password is. Each extra bit doubles the guesses needed. The meter calls 60 bits or more Strong and 80 bits or more Very strong. A 16 character password with all types is about 103 bits.
Can I generate multiple passwords at once?
Yes. Use Generate in bulk to create up to 100 passwords with your current settings, then copy them all or download them as a .txt file.
Why won't a website accept my generated password?
Some sites cap the length or allow only certain symbols. Shorten the length, or edit Symbols to use so it holds only the characters the site accepts, and a new password is generated.
Should I change my passwords regularly?
Current guidance (NIST SP 800-63B) says no. Forced changes lead to weaker, predictable passwords. Change a password when it appears in a breach or you think someone else knows it.
More free tools
Other tools you might need
SSL Checker
Check a site's certificate before you type a password into it.
QR Code Generator
Share your new Wi-Fi password as a QR code guests can scan.
Email Signature Generator
A professional signature with your photo and links.
Invoice Generator
Make a clean invoice and download it as a PDF.
Hyperlink Generator
Turn a URL into a ready-to-paste HTML link.
Website Speed Test
See how fast any page loads and what slows it down.
Did this tool help you?
Tap a star. It takes a second, no sign-up.
–
0.0 0 ratingsNo ratings yet.
Generate a strong password in one click
Random, private and free. Made on your device, never stored.