The free online password generator builds a strong random password or a memorable passphrase, with a live strength meter. Because it runs on the browser's secure random generator, the password is never uploaded.
Security tools by OnlinePCApps since 2013
A password a person invents follows a pattern an attacker can guess. The free online password generator makes one from true randomness, strong by the numbers rather than by feel.
A password thought up by a person leans on names, dates and common swaps that a cracker tries first. Drawing each character from the browser's secure random generator removes that pattern, so the strength is real rather than a guess.
A master password has to be recalled rather than stored, and a random string of symbols resists that. A passphrase of several random words is as strong yet reads and sticks in the mind, which is why it suits the one password kept in a head.
A password made on a website only stays secret if it is never transmitted. This generator runs entirely in the browser, so the password is built on the device and never sent anywhere, which is the whole point of making one this way.
Set the length and turn on uppercase, lowercase, numbers and symbols. Or switch to passphrase mode and pick a word count. Ambiguous characters such as O and zero can be left out for a password read aloud.
Generate the password and read the strength meter, which shows the entropy in bits from the length and the character pool. Generate again for a fresh one until the strength and the shape suit the account.
Copy the password and save it in a password manager rather than a note or a reused login. Nothing is kept on the page, so once it is copied and stored it lives only where it is put.
To generate a password is to draw random characters into a strong secret. The tool does that on the device.
Set the length and turn on uppercase, lowercase, numbers and symbols to shape the pool the characters are drawn from. A longer password with a wider pool is stronger, and the length counts for as much as the mix.
Passphrase mode picks several random words from the EFF wordlist and joins them, in the Diceware style. Each word adds close to thirteen bits, so a handful of words is strong yet far easier to remember than a symbol string.
A strength meter shows the entropy in bits, worked out from the length and the size of the character pool. Eighty bits is a solid floor and a hundred and twenty-eight is very strong, past which other risks matter more.
An option leaves out the characters that look alike: the letter O and a zero, or a one, an l and a capital I. That suits a password read aloud or typed from a screen, at a small cost to the character pool.
To generate a password, to make a strong random one and to build a passphrase all name the same tool. A search for password generator or strong password reaches this page, and nothing about the password is sent anywhere.
A strong password comes down to randomness and length. These points decide how strong the result is.
| The case | Result | What happens and why |
|---|---|---|
| Randomness | secure RNG | Each character comes from crypto.getRandomValues, not the guessable Math.random. |
| Length | counts most | A longer password gains as much strength as a wider character set, or more. |
| Character sets | four pools | Uppercase, lowercase, numbers and symbols widen the pool per character. |
| Passphrase | EFF words | Several random words from a 7,776-word list, close to thirteen bits each. |
| Entropy | in bits | Length times the log of the pool size, the true measure of strength. |
| Target | 80 to 128 | Eighty bits is a solid floor, and a hundred and twenty-eight is very strong. |
| Ambiguous | optional | Look-alike characters such as O and zero can be left out for readability. |
| Storage | a manager | Save it in a password manager and never reuse it across accounts. |
| Where it runs | on the device | The password is generated in the browser, so nothing is uploaded. |
How a Strong Password Is Made
The strength of a password rests on two things, and neither is the trick a person reaches for. The first is real randomness. A generator worth using draws each character from crypto.getRandomValues, the browser's cryptographically secure random source, rather than Math.random, which is predictable and unfit for a secret. The second is entropy, the number of bits that measures how hard a password is to guess, worked out as the length times the base-two log of the character pool. This is why length carries so much weight. Adding one character to a password buys about as much entropy as switching to a much larger set of symbols, and two extra characters buys more. A useful floor is eighty bits, with a hundred and twenty-eight very strong, and there is little point pushing far past that, since other risks such as phishing take over. Modern guidance from NIST agrees, having dropped forced symbols and forced periodic changes in favour of length and randomness. A passphrase of several random words is the friendly form of the same idea, since each word from the EFF list adds close to thirteen bits and the result is far easier to remember. The references below set out the details.
Both make a strong password. The trade is between a quick one-off and a tool that also stores it.
| Point of comparison | This tool Generated in the browser On the device | A password manager A separate stored vault |
|---|---|---|
| Where it is made | In the browser | On the device too |
| Price and caps | Free with no file cap | Free tier often capped |
| Stores and fills it | Copy it out by hand | Saves and autofills it |
| Sync across devices | This one page only | Shared across a vault |
| A quick one-off | Open and generate, no account | Set-up and a vault first |
A password manager is the right home for passwords used every day, since it stores, fills and syncs them across a vault. This page is for a quick strong password with no account, and a manager is where to keep it. Both make the password on the device.
Every password is built inside the browser by its own secure random generator, so the work is client-side and the result stays on the machine that made it. Nothing is passed to a server, which is the whole point of generating a secret this way.
A password only stays secret if it is never sent anywhere, so a generator that made one on a server would defeat itself the moment it did. Here the secret is created and shown on the device, and it lives only where it is copied and saved afterward.
Each of these makes a password. They vary in reach, in storage and in how random the result is.
A manager, the browser, code and dice all make a password, yet each means an account, a script or a slow roll. This page generates a strong one on the secure random source with a strength meter, kept local with nothing to set up.
A little context sets a safer password.
A longer password is stronger than a short one loaded with symbols, and adding a character helps about as much as widening the pool. Reach for length first, which is the change modern guidance now leans on.
A password reused across sites turns one breach into many. Give each account its own generated password and keep them in a password manager, so a leak on one site cannot open the rest.
For the one password kept in a head, a manager master key, several random words beat a symbol string. A six or seven word passphrase is strong and memorable, which is why it fits where a password has to be recalled.
The browser generates a strong one-off password, which suits a quick need. A password used and filled on every login, or a whole set of accounts, belongs in a password manager, which generates, stores and syncs each one and fills it where it is needed.
A manager saves each generated password and fills it on the right site, so a unique password per account is no burden to use.
A vault syncs, so a password made on one device is there on a phone or a laptop, filled the same way everywhere.
A manager can flag a reused or a leaked password, so a weak one is caught and replaced before it is a way in.
Free and online, with no sign-up and no upload. Build a strong password in the browser, all on the device.