How do I generate a strong random password?

Choose the Password type, drag Length (4 to 64 characters), select Uppercase, Lowercase, Numbers and Symbols, then press Generate. A 16-character password with all four sets is the default.

Is the password generated randomly and kept private?

Characters are picked with the browser's crypto.getRandomValues, not Math.random, and generation happens on your device with no network request. The tool also shows entropy in bits and a crack-time estimate.

What is the difference between a password, a passphrase and a PIN here?

Password mixes characters you select. Passphrase joins 3 to 10 words from the EFF Short Wordlist with a separator you choose. PIN is 4 to 12 digits, avoiding repeated or sequential runs like 111 or 123.

Can I create many passwords at once?

Yes. The How many setting offers 1, 5, 10, 25, 50 or 100. You can copy them all, or download them as .txt or .csv, or copy as JSON.

How do I avoid characters that look alike, like 0 and O?

Turn on Exclude similar (1lI0O) to remove look-alike characters. The Easy to read and say preset also drops symbols. You can also set your own Allowed symbols if a site rejects some.

Yes. Every tool is free to use, with no account and no credit card. The work runs on your device rather than on our servers, which is what keeps it free to run.

Does it work on mobile?

Yes. It runs in current mobile browsers on iOS and Android, with nothing to install.

🔐

Free Password Generator

Generate strong, random passwords with custom length, character types, and exclusions. Free, no login.

Runs in your browserNo sign-up, no pop-upsNo login requiredFree forever

Works offline once loaded

Length16

464

Uppercase (A-Z)Lowercase (a-z)Numbers (0-9)Symbols (!@#$...)Exclude similar (1lI0O)No ambiguous symbols {}[]()/\'"~,;:.<>

Allowed symbols

Leave empty for the default list. Spaces are ignored.

How many

Press R to generate a new password

Common uses

Generate a Secure Banking PasswordCreate a long, complex password for your bank, investment, and financial accounts.
Generate a Strong WiFi PasswordCreate a secure WiFi password that's hard to guess but easy to share via QR code.
Generate a Work Account PasswordMeet corporate password requirements — length, complexity, and character type rules.
Generate a Secure API KeyCreate random, high-entropy strings for use as API keys, secret tokens, and signing secrets.
Generate a Database PasswordCreate strong passwords for database users, root accounts, and service connections.

How It Works

Passwords are generated entirely in your browser using the Web Crypto API's crypto.getRandomValues() — the same cryptographic random source browsers use for TLS. No Math.random(), no server, no network request of any kind.

1
Character pool assembly
Based on your checkbox selections, the tool builds separate arrays for uppercase, lowercase, digits, and symbols. If 'exclude similar characters' is on, visually ambiguous characters like 1, l, I, 0, and O are stripped from each set before the pool is formed.
2
Rejection-sampled random selection
Each character position is filled using crypto.getRandomValues() with rejection sampling: if a raw random value falls in the biased tail of the distribution, it is discarded and redrawn. This eliminates modulo bias that would make some characters statistically more likely than others.
3
Guaranteed class coverage
After sampling the full password, the tool checks whether at least one character from every selected class is present. If not, it resamples the entire password and checks again — up to 100 times — rather than swapping characters into fixed slots, which would skew the distribution.
4
Entropy and crack-time estimate
The tool computes entropy as length × log2(pool size) and estimates crack time using log-space arithmetic against a 100 billion guesses-per-second GPU baseline (appropriate for fast hashes like MD5; bcrypt/Argon2-protected passwords would take far longer). Both figures update instantly as you change settings.

The generator runs entirely in your browser — no passwords, settings, or usage data are ever sent to a server.

Related Tools

🔒

Password Strength Checker

Check how strong your password is with entropy analysis, crack time estimates, and a detailed checklist of requirements. Runs entirely in your browser.

Try it

🔐

Text Encryption

Encrypt and decrypt text with a password using strong AES-256-GCM. The password never leaves your browser. Share secrets safely.

Try it

🔐

File Encryption (AES-256-GCM)

Encrypt any file with a password using AES-256-GCM and PBKDF2 (250,000 iterations). The .enc output opens only with the right password, and only this tool can decrypt it. Fully client-side — your file never leaves your device.

Try itFiles stay local