TOOLS · PASSWORD
Generate strong passwords or memorable passphrases.
Random character passwords or word-based passphrases, generated using your browser's own crypto API — free, instant, and never sent anywhere.
How This Tool Works
Every password is generated locally, using crypto.getRandomValues() — your browser's own cryptographically secure random number source, the same one used for things like session tokens. Nothing is sent to a server, and nothing is logged; refresh the page and the password is gone unless you copied it.
Random mode builds a password from a mix of character types you choose (lowercase is always included; uppercase, numbers, and symbols are optional). Memorable mode instead strings together a handful of real, unrelated words — easier to type or read aloud, at the cost of being slightly more predictable per character than a fully random string of the same length.
What Makes a Password Strong
- Length matters more than complexity — a longer password beats a shorter one with more symbols crammed in, character for character.
- Randomness matters more than pattern — "Tr0ub4dor&3"-style substitutions (a→4, o→0) are well known to attackers and don't add as much real protection as they look like they do.
- Uniqueness matters most of all — the single biggest real-world password risk is reusing the same password across multiple sites, since one breach then exposes every account that shares it.
Frequently Asked Questions
Is it safe to generate a password for a real account here?
Yes — generation happens entirely in your browser using the Web Crypto API, and the password is never transmitted anywhere. You can verify this yourself by checking your browser's network tab while using the tool.
Should I use Random or Memorable mode?
Random mode packs more entropy per character, so it's the stronger choice when the password will be stored in a password manager and never typed by hand. Memorable mode trades a little strength for being realistically typeable or readable aloud — reasonable for something you'll need to enter manually on a regular basis.
How long should my password be?
12 characters is a commonly cited minimum; 16 or more is a safer default for anything important, and this tool defaults to 16. Longer is better as long as the account you're using it for actually allows it.
Why does the strength indicator matter if the password is already random?
It reflects the password's actual entropy (how many attempts it would realistically take to guess) based on its length and the character types used — useful for judging whether a shorter, easier-to-type password is still strong enough for what you're using it for.