How to Use This Tool
This free online strong password generator creates random passwords and passphrases using your browser's cryptographic random number generator. Unlike a score guessed from a user-chosen phrase, the entropy readout is calculated from the actual pool and settings used to generate the result. Choose any length from 6 to 80 characters, or use the quick control for exactly 12.
Random string mode
Set a length and choose which character classes to include. The entropy figure updates immediately using
bits = length × log₂(pool size). Every character added at a 94-symbol pool is worth
about 6.55 bits, which is why length beats complexity: going from 12 to 16 characters adds far more
security than adding one symbol to a 12-character password.
Two options are worth understanding. No 0/O, 1/l/I removes visually ambiguous characters, which is genuinely useful for anything a human will read off a screen and type elsewhere. It costs a small amount of entropy, and the readout accounts for it. No repeats forbids the same character appearing twice; it feels safer and is in fact very slightly weaker, because it removes possibilities from the space. The tool calculates the reduced entropy honestly rather than pretending otherwise.
Passphrase mode
Passphrases trade character density for memorability. The word list here holds 585 curated, easily typed words, so each word contributes about 9.2 bits. Six words gives roughly 55 bits and seven gives about 64 — strong enough for most accounts and vastly easier to type on a phone or a games console than a 20-character symbol soup. The exact figure is computed from the real list length rather than a rounded claim, so the readout moves as you add words.
Add words rather than adding punctuation. Each extra word is worth another 9.2 bits, while capitalising the first letter of every word is worth almost nothing, because an attacker assumes that pattern before they assume anything else.
Understanding the guess-time estimate
The estimate shows one hypothetical offline search scenario. Its rate is an editable assumption, not a measured speed for a GPU, cloud account, or real password database. The calculation assumes every candidate in the generator's equally likely search space could be tried and displays the average time to reach the correct value. Actual results depend on the service's password-hashing algorithm and cost settings; an online login also has controls such as throttling and multifactor authentication. Do not treat an estimate as a guarantee.
When a service stores passwords, a salted, adaptive password hash adds computational cost to each guess. OWASP's guidance explains why the algorithm and work factor matter, so a generic guess rate cannot predict the time against an unknown service. Read OWASP's password storage guidance.
Where the randomness comes from
Each random choice uses crypto.getRandomValues() with rejection sampling. The password or passphrase is generated in this page and is not submitted to an ECECH password endpoint or saved by this generator. Copying it deliberately places it on your device's clipboard. Browser extensions, screen capture, compromised devices, and third-party page resources are outside this generator's control; for sensitive accounts, consider generating a password inside a trusted password manager.
NIST's current digital identity guidance says verifiers should support passwords at least 64 characters long and should not require character-class composition rules. A particular website may still impose its own limits, so check the service's requirements. Read NIST SP 800-63B.
