An offline attacker at 100 billion guesses a second would need longer than the universe has existed on average.
About Password Generator
Generate strong random passwords and passphrases using your browser's cryptographic randomness, with an honest strength estimate.
What it does
Produce random passwords with control over length and character sets, or word-based passphrases that are far easier to type and remember. Randomness comes from the Web Crypto API — the same secure source browsers use for cryptographic keys — not from Math.random(), which is predictable and unsuitable.
An honest strength meter
The strength figure is entropy in bits, computed from the actual generation parameters, rather than a green bar that rewards adding an exclamation mark. Length matters far more than symbol variety: a passphrase of five random words beats a shorter password full of substitutions, and is much easier to type on a phone. Anything above roughly 80 bits is beyond brute force with foreseeable hardware.
Generated locally, and not stored
Passwords are generated in your browser and never transmitted. Nothing is logged and nothing persists after you close the tab — which is the only sane property for a tool of this kind. Use a password manager to store what you generate.
Common questions
- Is this actually random?
- Yes. It uses crypto.getRandomValues(), the browser's cryptographically secure generator, not Math.random().
- Is the password sent anywhere or saved?
- No. It is generated in your browser, never transmitted, and not stored anywhere after you leave the page.
- Password or passphrase?
- A passphrase of five or six random words is both stronger and far easier to type than a short symbol-heavy password. Use a random password where a service caps the length.
- How long should a password be?
- For a random password, 16 characters or more. What actually matters is entropy: above about 80 bits, brute force stops being a realistic threat.
- Does substituting 3 for e make a password stronger?
- Barely. Cracking tools have applied those substitutions for decades. Length and genuine randomness are what count.