Strong password generator

Generate strong random passwords or passphrases in your browser, with a strength score and entropy shown next to each one.

How to generate a strong password

1
Set the length and character sets
Pick a length from 4 to 128 characters, or switch to a passphrase of 4 to 10 words. Turn character sets on or off, or exclude look-alike and hard-to-type characters.
2
Generate and check the strength
Every password is built from crypto.getRandomValues with rejection sampling, so no character is ever slightly more likely than another. Paste anything into the strength checker to see its score.
3
Copy it straight into your password manager
Copy a single password with one click, or download the whole batch as a text file. The clipboard clears itself after 60 seconds.

Where the randomness comes from

Every character and every word is chosen with crypto.getRandomValues, the same cryptographically secure source browsers use for keys and tokens. Math.random is never used anywhere in this tool: it is fast but predictable, which is exactly the wrong property for a secret. To avoid modulo bias, values outside a clean multiple of the alphabet size are rejected and redrawn instead of being reduced with a remainder, so every character in your chosen set has exactly the same chance of appearing.

Passwords vs. passphrases

A 20-character password from the full 85-character alphabet (lower case, upper case, digits and 23 symbols) carries about 128 bits of entropy, far beyond what any offline attack can search. A 5-word passphrase built from the EFF's 7,776-word list carries about 65 bits, which is still very strong and considerably easier to type or read aloud. Longer passphrases close the gap quickly: every extra word adds roughly 12.9 bits, so a 7-word phrase already passes 90 bits.

Nothing you generate ever leaves this tab

There is no network request involved in generating, checking or copying a password; everything happens locally in JavaScript. Passwords are never written to localStorage, sessionStorage or the pipeline, and only a generic "button pressed" event with the length and character sets (never the value) reaches analytics.

Frequently asked questions

Do you store the passwords I generate?

No. Nothing is sent to a server, and nothing is written to browser storage. The password exists only in this page's memory until you close or refresh the tab.

Where does the randomness come from?

The Web Crypto API's crypto.getRandomValues, the browser's cryptographically secure random number generator. It is available in every modern browser and costs nothing to load.

What password length is enough in 2026?

16 characters from a mixed alphabet is a comfortable minimum for most accounts; 20 or more is better for anything protecting money or your email. The strength score and entropy figure next to each generated password give you a concrete number rather than a rule of thumb.

Is a password or a passphrase better?

Both are strong when long enough. A passphrase is easier to type and read aloud, which matters if you ever enter it by hand; a character password packs more entropy per character. Pick whichever you are less likely to shorten out of impatience.

What does the score from 0 to 4 mean?

It comes from a strength estimator that looks for dictionary words, dates, keyboard patterns and common substitutions rather than just counting characters. 0 to 2 means the password is guessable with modest effort; 4 means no known pattern-based attack gets close.

Why does the copied password get cleared from my clipboard?

Sixty seconds after you copy, this tool overwrites the clipboard with an empty string, and a countdown next to the button shows how long is left. That way a password does not linger somewhere another app or website could read it back later.

Can I use this without an internet connection?

Yes, once the page has loaded. Character passwords need nothing further; a passphrase or a strength check loads a small word list or scoring library the first time you use it, then works offline for the rest of the session.