Free password generator

How this generator works

Every password on this page comes fromcrypto.getRandomValues — the cryptographically secure random number generator built into your browser, the same source a password manager uses. Characters are drawn with rejection sampling, so every character in the pool is exactly equally likely; naive generators that use a modulo introduce a small bias toward the start of the alphabet, and this one doesn't.

Passphrases are drawn from theEFF short wordlist — 1,296 words chosen by the Electronic Frontier Foundation to be memorable, distinct and easy to type. Each word adds about 10.3 bits of entropy, so five words carry roughly 52 bits: outside the reach of realistic guessing, and still something you can say out loud.

The whole thing is a page of client-side code. There is no request to generate, no request to copy, nothing logged — which you can verify yourself: open your browser's network tab, or turn off your connection and keep generating.

Password or passphrase — which should you use?

Use both, for different jobs. A random password(20+ characters, all sets on) is for accounts a password manager fills for you — you never type it, so it can be as hostile as it likes. Apassphrase (five or more words) is for the handful of secrets you type by hand: your computer login, your password manager's master password, an encrypted vault. Five random words beatTr0ub4dor!-style substitutions on both security and memory.

What this tool doesn't solve

Honest limits: a strong password doesn't help if it's reused across sites, typed into a phishing page, or stored in a note on your desktop. Generation is the easy step — storage is the real problem. Wherever you keep passwords, use a different one per account, and turn on two-factor authentication for the accounts that matter most.

Frequently asked questions

Is it safe to use an online password generator?

It depends on where the password is made. This generator creates passwords on your own device, using your browser's built-in cryptographic randomness — the page never sends anything anywhere, and it keeps working with your internet switched off. A generator that creates passwords on a server has to be trusted not to log them; one that runs only in your browser removes that question.

Are the passwords stored or sent anywhere?

No. There is no server involved, no analytics on the value, and nothing is written to disk. The password exists only on your screen and, if you press copy, in your clipboard. Reload the page and it is gone.

How long should a password be?

For anything that matters, 16 characters or more with all character types on — that lands around 100 bits of entropy, far beyond realistic guessing. For a password you must remember and type, a passphrase of five random words is both stronger and easier than a short scramble like Tr0ub4dor!.

What is a passphrase, and when is it better?

A passphrase is a password made of random words — like ocean-tidy-crayon-shrug-nifty. Five words drawn from this page's 1,296-word list carry about 52 bits of entropy and are far easier to remember and type than symbols. Use passphrases for the few passwords you type by hand (your computer login, your vault); use long random passwords for everything a password manager fills for you.

Should every account get a different password?

Yes, without exception. Reuse is how one leaked site becomes every account you own: attackers replay leaked email-and-password pairs everywhere else. A unique random password per site makes a breach at one service end at that service.