Password Generator

Generate strong, random passwords instantly. Fully client-side — nothing leaves your browser.

100% Client-Side No Signup Instant
Length 16
Uppercase A–Z
Lowercase a–z
Numbers 0–9
Symbols !@#$%^&*()
Exclude ambiguous O 0 I l 1 |
Count:
Generated entirely in your browser using crypto.getRandomValues(). Nothing is sent to any server.

How to Use the Password Generator

1

Choose Your Mode

Select Random for character-based passwords, Passphrase for word-based passwords, or PIN for numeric codes.

2

Adjust Settings

Set your desired length, toggle character types on or off, and pick presets for common lengths.

3

Copy & Use

Your password generates instantly. Click Copy to save it to your clipboard, or regenerate for a new one.

What Makes a Strong Password?

According to NIST SP 800-63B (2024) and CISA guidelines, password strength depends on three factors: length, randomness, and uniqueness. The updated federal standards dropped mandatory complexity rules (mixed case, special characters) in favor of longer passwords, because each additional character exponentially increases brute-force difficulty.

Here are 5 rules for creating strong passwords in 2026:

Password Strength by Length

How long would it take to crack your password? These estimates are based on 2025 data from Hive Systems, assuming a modern GPU cluster (12x RTX 5090) attacking bcrypt hashes at 10 billion guesses per second:

LengthNumbers OnlyLowercase+ UppercaseAll CharactersEntropy (all)
6InstantInstantInstant1 second39 bits
8Instant57 minutes4 days8 months53 bits
10Instant2 years300 years58K years66 bits
123 minutes2,000 years880K years3 billion years79 bits
145 hours2M years600M years31 trillion years92 bits
1621 days477M years380B years30 quadrillion years105 bits
205 years39T years253,000T yearsEffectively never131 bits
321B yearsBeyond heat death of the universe210 bits

Times assume offline brute-force against bcrypt hashes. Online attacks with rate limiting are much slower. Weak hashing (MD5, SHA-1) reduces times by orders of magnitude.

Password vs. Passphrase

A passphrase is a sequence of random, unrelated words (e.g., “correct-horse-battery-staple”). Here is how they compare to traditional random passwords:

CriteriaRandom PasswordPassphrase
Examplek7#mQ9$xL2!pN4wcorrect-horse-battery-staple
Typical length12-20 characters20-40 characters
Entropy (typical)79-131 bits52-108 bits (4-7 words)
MemorabilityImpossible without a managerModerate — mental imagery helps
Typing easeLow — mixed symbolsHigh — regular words
Best forWebsite accounts (stored in manager)Master passwords, device encryption
NIST compliantYes (if 15+ chars)Yes (if 15+ chars)

Key insight: Passphrases trade entropy density for memorability. A 5-word random passphrase (~86 bits) is easier to remember than a 12-character random password (~79 bits) while being more secure. For maximum security, use random passwords stored in a password manager.

Common Password Mistakes

According to NordPass’s 2025 analysis of dark web data, the 10 most common passwords are:

#PasswordOccurrencesTime to Crack
1123456179.9MInstant
212345678967.4MInstant
31234567863.9MInstant
4password46.6MInstant
51234528.3MInstant
6qwerty22.0MInstant
7123456716.3MInstant
8123456789015.8MInstant
911111112.2MInstant
10qwerty12312.0MInstant

Every one of these is cracked instantly. The top 5 password mistakes people make:

Frequently Asked Questions

Yes. This generator runs entirely in your browser using JavaScript. No passwords are ever sent to any server. It uses crypto.getRandomValues(), the browser's built-in cryptographically secure random number generator — the same API used by password managers like Bitwarden and 1Password.
A strong password has three properties: length (at least 16 characters, per CISA recommendations), randomness (no dictionary words, names, dates, or patterns), and uniqueness (never reused across accounts). NIST dropped mandatory special character requirements in favor of length, because each additional character exponentially increases brute-force difficulty.
NIST now requires a minimum of 15 characters for single-factor authentication (SP 800-63B Rev. 4). CISA recommends 16 or more characters. For multi-factor authentication, 8 characters is the minimum. The sweet spot for most users is 16-20 characters — long enough to be secure for decades, manageable with a password manager.
A passphrase is a sequence of 4-7 random, unrelated words (e.g., “correct-horse-battery-staple”). A 5-word random passphrase has roughly 86 bits of entropy — stronger than a 12-character complex password (~79 bits) — while being easier to remember. Passphrases are ideal for master passwords where you need to type from memory. For website accounts, random character passwords stored in a password manager are equally secure and more practical.
NIST no longer recommends routine password changes. The updated 2024 guidelines explicitly state organizations “shall not” require periodic password rotation unless there is evidence of compromise. Forced changes led to predictable patterns. Change your password only when you suspect it was compromised, a service reports a data breach, or you have been sharing the password and want to revoke access.
Entropy measures password unpredictability in bits. The formula is E = log2(R^L), where R is the character pool size and L is the password length. Each bit doubles the number of possible combinations. Under 35 bits is weak (cracked in minutes), 60-75 bits is strong, 75-100 is very strong, and 100+ bits is excellent. A 16-character password using all character types has about 105 bits of entropy.
Two-factor authentication requires a second verification step beyond your password — typically a code from an authenticator app, SMS, or a hardware security key. Even if your password is stolen, the attacker cannot access your account without the second factor. Authenticator apps (Google Authenticator, Authy) are more secure than SMS, and hardware keys (YubiKey) are the most secure option. Enable 2FA on email, banking, and social media at minimum.
Attackers use several methods: Brute force tries every combination (fast for short passwords, impractical for 16+ characters). Dictionary attacks try common words, names, and leaked passwords. Credential stuffing uses stolen username/password pairs from one breach to log into other sites. Rainbow tables use precomputed hash lookups for offline cracking. Phishing tricks you into entering credentials on fake sites. A random 16-character password defeats brute force and dictionary attacks; unique passwords defeat credential stuffing.
Yes. CISA, NIST, and every major security organization recommends using a password manager. It generates, stores, and auto-fills strong unique passwords for every account — you only remember one master password. This eliminates password reuse, the number one cause of account takeovers. A password generator (like this tool) creates the passwords; a password manager stores them. Popular options include Bitwarden (free/open-source), 1Password, and Dashlane.
Yes, completely free with no limits. No registration, no account required, no restrictions on how many passwords you can generate. The tool runs in your browser with zero server interaction. Use it as much as you need.

Related Tools