Password Generator
Generate secure random passwords and passphrases with customizable options and strength analysis.
About This Tool
How strong is a 12-character random password? With uppercase,
lowercase, digits, and symbols (95 characters), a 12-character
password has about 78 bits of entropy — meaning an attacker
would need roughly 2^78 (over 300 sextillion) guesses to crack
it by brute force. This tool generates passwords at that level
and beyond, using the Web Crypto API
(crypto.getRandomValues()) for true randomness.
All generation runs in your browser. No passwords are ever sent to a server or logged — safe for production credentials, API keys, and any context where privacy matters.
The tool offers two modes. Password mode lets you
configure the exact character set — uppercase letters,
lowercase letters, digits, and symbols — along with the
password length (8 to 128 characters). You can also exclude
ambiguous characters like 0, O,
1, l, I, and
| that are easy to confuse in certain fonts.
Passphrase mode generates a sequence of random English words joined by a separator of your choice. Passphrases are easier to remember while still providing strong entropy. A four-word passphrase drawn from a 7,776-word list yields about 51 bits of entropy; each added word contributes roughly 12.9 bits more. Bulk generation lets you create up to 100 passwords at once and copy them all with a single click. Need unique identifiers rather than passwords? Try our UUID Generator or Hash Generator.
How to Use
- Choose a mode: Password for random character strings, or Passphrase for random word sequences.
- In Password mode, adjust the length slider and select which character types to include (uppercase, lowercase, digits, symbols).
- Optionally toggle Exclude ambiguous characters to avoid visually similar characters.
- In Passphrase mode, adjust the word count, choose a separator, and optionally capitalize the first letter of each word.
- The password generates automatically when settings change. Click the regenerate button to create a new one with the same settings.
- Click Copy or press Ctrl+Shift+C to copy the password to your clipboard.
- Use the Bulk Generate buttons to create multiple passwords at once (1, 5, 10, 50, or 100).
Popular Password Generation Examples
FAQ
Are the generated passwords truly random?
Yes. The tool uses crypto.getRandomValues(), which is a cryptographically secure pseudo-random number generator (CSPRNG) built into every modern browser. It draws entropy from the operating system's random number source, making the output suitable for security-sensitive use cases.
Is my password sent to any server?
No. Passwords are generated using the Web Crypto API (crypto.getRandomValues()) running in your browser's JavaScript engine. No network requests are made during generation — you can confirm this in your browser's DevTools Network tab.
What does the entropy score mean?
Entropy measures the unpredictability of a password in bits. A password with 40 bits of entropy would require roughly 2^40 (about one trillion) guesses to crack by brute force. Generally, 60+ bits is considered good for most accounts, and 80+ bits is considered strong for high-security applications.
Should I use a password or a passphrase?
Both can be secure. Random character passwords pack more entropy per character, making them shorter but harder to remember. Passphrases use common words, making them easier to memorize while still offering strong security when you use four or more words. For passwords you need to type manually, passphrases are often more practical.
Why exclude ambiguous characters?
Characters like 0 (zero) and O (capital O), or 1 (one) and l (lowercase L), look nearly identical in many fonts. When you need to read or manually type a password, excluding these characters reduces transcription errors. The trade-off is a slightly smaller character pool, which marginally lowers entropy.
Related Tools
Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes for text and files.
UUID Generator
Generate, validate, and inspect UUIDs in v4 and v7 formats.
JWT Decoder
Decode JSON Web Tokens to inspect header, payload, and verify signatures.
Lorem Ipsum Generator
Generate placeholder text in paragraphs, sentences, or words with HTML wrap options.
Text Encrypt / Decrypt
Encrypt and decrypt text with AES-256-GCM using a password. All processing in your browser.
Password Strength Analyzer
Analyze password strength with entropy calculation, pattern detection, and time-to-crack estimation.
Bcrypt Generator
Generate bcrypt password hashes and verify passwords against existing hashes. Configurable salt rounds.