Password Generator
Create random passwords and memorable word passphrases with a visible entropy estimate — no sign-up.
- Fewer clicks, keyboard friendly
- Features others lock behind paywalls
How to use
- Choose Random password for account rules, or Word passphrase when you need something easier to type and remember.
- Set the password length and character types, or choose 2 to 12 words and a separator.
- Check the entropy estimate and strength label before using the result.
- Select Generate password or press R outside an input field to make a fresh value.
- Copy the result and save it in a trusted password manager; generate a different value for every account.
What the entropy number means
Entropy is shown in bits: a result space with n possible equally likely values has log₂(n) bits. This tool uses the browser’s crypto.getRandomValues() source and rejects remainder values so a selected character is not made slightly more likely by modulo arithmetic. When multiple character types are enabled, it keeps drawing until every enabled type appears, then counts that exact eligible result space for the estimate. It is an estimate of brute-force search space, not a promise about phishing, malware, a breached service, or a reused password.
Random passwords and word passphrases
A random character password works well when a service imposes composition rules such as a number or symbol. The generator guarantees each enabled category appears. The word mode joins 2 to 12 independently selected words from its fixed 128-word list, so every word contributes 7 bits of selection entropy; six words show 42 bits. Longer phrases are easier to enter accurately than a short opaque string, but every site has its own maximum length and permitted-character rules. Keep a unique generated password for each account instead of adapting one old password.
Current password guidance favors length and uniqueness
NIST SP 800-63B says a password used as the only authentication factor must be at least 15 characters, while passwords used with multi-factor authentication may be at least 8 characters. It also says verifiers should allow at least 64 characters and should not impose other composition rules. Those are requirements for systems that accept passwords, not universal account settings: many websites still require particular characters. Use the rules shown by the service, turn on MFA where available, and replace a password if the service reports a compromise.
Frequently asked questions
Is this password generator safe to use?
Yes, the generator uses the browser crypto.getRandomValues() API and generates the result locally. It does not save or transmit generated passwords; copy the value into a password manager or the account form, then generate a different one for the next account.
How long should a strong password be?
For a password used without another factor, NIST SP 800-63B specifies a minimum of 15 characters for the verifier; the practical limit is the individual service’s rules. A unique 20-character random password is the default here, while a word passphrase can be lengthened by adding words.
What does password entropy in bits mean?
Password entropy in bits is log₂ of the number of possible generated results under the selected settings. For example, six independently chosen words from this generator’s 128-word list have 42 bits because 6 × log₂(128) equals 42.
Are word passphrases easier to remember?
A random word passphrase is usually easier to read and type than a similarly long punctuation-heavy string. This tool selects each of 2 to 12 words independently, so use more words for a larger search space and do not replace them with personal facts or a familiar quote.
Should I exclude similar-looking characters?
Exclude look-alike characters when you must read or manually type the password, because I, l, 1, O, and 0 are easy to confuse. Leaving them available gives a slightly larger character pool, so use copy and paste when the destination permits it.
Related tools
Updated 2026-10-16