Free Password Generator
Generate strong, random passwords right in your browser. Nothing is stored, sent or logged - Ever.
Privacy-first by design: Wallet passwords are encrypted on your device with AES-256 — we couldn't read them even if we tried.
Generated with your browser's cryptographically secure random number generator (CSPRNG). How it works →
Need More Than One? Generate in Bulk
Creates a whole list at once - Handy when provisioning accounts or seeding a password manager. Uses the same length and character options you set above, and like everything here, the list never leaves your browser.
How to Use This Password Generator
Set the length
Drag the slider to 16+ characters - 20+ for email, banking or anything an attacker would love.
Pick character types
Keep all four switched on unless a site forbids symbols. Exclude ambiguous helps if you'll ever type it by hand.
Copy it
One click copies to your clipboard. Regenerate as many times as you like - Each press is a fresh roll of the dice.
Save it safely
Hit Save to Wallet to store it encrypted on your device, or paste it straight into your password manager.
Weak vs. Strong: What a Real Difference Looks Like
Crack times assume an offline GPU rig testing 100 billion guesses per second against a fast hash - The worst realistic case. Never use any example you've seen printed, including these.
| Password pattern | Why people pick it | Entropy | Cracked in |
|---|---|---|---|
jessica2019 - Name + year | Easy to remember | ~14 bits | instantly |
P@ssw0rd! - L33t dictionary word | Passes complexity rules | ~20 bits | instantly |
Summer2026!! - Word + year + symbols | Meets every checkbox | ~28 bits | seconds |
| 8 random characters, all types | Old advice said "8 is enough" | ~52 bits | hours |
| 12 random characters, all types | Solid modern floor | ~78 bits | thousands of years |
| 16 random characters, all types | This generator's default | ~105 bits | longer than the universe has existed |
| 5 random words (passphrase) | Strong and memorable | ~55 bits | ~11 years |
Entropy estimates follow the method in our entropy guide; pattern-based passwords lose most of their theoretical entropy because cracking tools try those patterns first.
Every Password Tool You Need
Passphrase Generator
Memorable multi-word passphrases (Diceware style).
PIN Generator
Random 4–12 digit PIN codes with no weak patterns.
Username Generator
Random, non-identifying usernames for new accounts.
WiFi Password Generator
Strong WPA2/WPA3 keys with a printable card and QR code.
Password Strength Checker
Entropy, crack-time estimates and pattern warnings - All offline.
2FA Code Generator
Generate TOTP secrets, QR codes and live 6-digit codes.
Password Breach Check
See if a password appears in known data breaches - Privately, via k-anonymity.
AES-256 Encryption
Encrypt and decrypt text with AES-256, right in your browser.
MD5 Hash Generator
Compute MD5 checksums of any text instantly.
SHA-256 Hash Generator
SHA-256, SHA-384 and SHA-512 hashes computed locally.
Base64 Encoder / Decoder
Encode and decode Base64 text and URLs.
UUID Generator
Random version-4 UUIDs, one or in bulk.
Case Converter
UPPER, lower, Title, camelCase and more.
Bcrypt Hash Generator
Hash and verify passwords with bcrypt - The slow hash built for passwords.
What Makes a Password Strong?
Length beats complexity
Every character you add multiplies the number of guesses an attacker needs. A random 8-character password using all character types has about 52 bits of entropy - crackable in hours on modern GPU rigs. At 16 characters the same mix reaches roughly 105 bits, which is beyond any realistic brute-force attack.
*Longer than the age of the universe at 100 billion guesses per second. Full math in our password entropy guide.
Random beats clever
Human-invented passwords follow patterns - A capitalized word, a year, an exclamation mark. Cracking software tries those patterns first, which is why P@ssw0rd2026! falls in seconds while a truly random string of the same length survives. Generators don't have habits; that's the whole point.
See how hackers actually crack passwords and check any password with our strength checker.
Password security golden rules
Aligned with NIST SP 800-63B guidance: length over complexity, no forced rotation, unique per account.
- 16+ characters for anything that matters, 20+ for email and banking.
- One password per account. Reuse is how one breach becomes ten - See credential stuffing.
- Use a manager. Store everything in an encrypted vault like our free Password Wallet and remember only one master passphrase.
- Turn on 2FA everywhere it's offered - Start with our 2FA setup guide.
- Only change passwords when there's a reason - A breach, a shared device, an offboarded employee.
Prefer something you can type?
For passwords you must remember - A laptop login or a master password - A random passphrase of five or six words (correct-horse-battery-staple style) gives you strong entropy and human memorability at the same time. Read what makes passphrases work.
8 Rules That Keep Every Password Safe
Generating a strong password is step one. These habits - Drawn from NIST SP 800-63B and what real attacks exploit - Keep it strong.
Never reuse
One breach shouldn't open ten doors. Unique password per account, no exceptions - especially email.
Length first
Each added character multiplies the search space. 16 random characters beats any clever 10-character trick.
Use a manager
Memory doesn't scale to 100+ accounts. An encrypted vault does - And it never mistypes.
Add a second factor
A TOTP code turns a stolen password into a dead end.
Check for breaches
Run important passwords through the breach check - If it's leaked, it's burned.
Beware of phishing
The strongest password fails if you type it on a fake page. Check the domain before you sign in.
Rotate on evidence
Change passwords after a breach or shared access - Not on a calendar. Forced rotation breeds weak patterns.
Guard the master key
Your manager's master passphrase deserves the most care: 6 random words, written backup, told to no one.