Password Generator
Generate strong, random passwords instantly. Fully client-side — nothing leaves your browser.
crypto.getRandomValues(). Nothing is sent to any server.
How to Use the Password Generator
Choose Your Mode
Select Random for character-based passwords, Passphrase for word-based passwords, or PIN for numeric codes.
Adjust Settings
Set your desired length, toggle character types on or off, and pick presets for common lengths.
Copy & Use
Your password generates instantly. Click Copy to save it to your clipboard, or regenerate for a new one.
What Makes a Strong Password?
According to NIST SP 800-63B (2024) and CISA guidelines, password strength depends on three factors: length, randomness, and uniqueness. The updated federal standards dropped mandatory complexity rules (mixed case, special characters) in favor of longer passwords, because each additional character exponentially increases brute-force difficulty.
Here are 5 rules for creating strong passwords in 2026:
- Make it long — 16 characters minimum. NIST now requires at least 15 characters for single-factor authentication. Every extra character multiplies cracking difficulty exponentially.
- Make it random — Use a password generator. Humans are terrible at randomness — we gravitate toward patterns, dictionary words, and personal info that attackers exploit.
- Make it unique — One password per account. 94% of passwords are reused across multiple accounts. When one service is breached, all your accounts using that password are compromised.
- Skip the complexity gimmicks — “P@$$w0rd!” looks complex but is trivially crackable. A 20-character lowercase random string is far stronger than an 8-character string with forced symbols.
- Use a password manager — The only practical way to maintain unique 16+ character passwords for every account. A generator creates the passwords; a manager stores them.
Password Strength by Length
How long would it take to crack your password? These estimates are based on 2025 data from Hive Systems, assuming a modern GPU cluster (12x RTX 5090) attacking bcrypt hashes at 10 billion guesses per second:
| Length | Numbers Only | Lowercase | + Uppercase | All Characters | Entropy (all) |
|---|---|---|---|---|---|
| 6 | Instant | Instant | Instant | 1 second | 39 bits |
| 8 | Instant | 57 minutes | 4 days | 8 months | 53 bits |
| 10 | Instant | 2 years | 300 years | 58K years | 66 bits |
| 12 | 3 minutes | 2,000 years | 880K years | 3 billion years | 79 bits |
| 14 | 5 hours | 2M years | 600M years | 31 trillion years | 92 bits |
| 16 | 21 days | 477M years | 380B years | 30 quadrillion years | 105 bits |
| 20 | 5 years | 39T years | 253,000T years | Effectively never | 131 bits |
| 32 | 1B years | Beyond heat death of the universe | 210 bits | ||
Times assume offline brute-force against bcrypt hashes. Online attacks with rate limiting are much slower. Weak hashing (MD5, SHA-1) reduces times by orders of magnitude.
Password vs. Passphrase
A passphrase is a sequence of random, unrelated words (e.g., “correct-horse-battery-staple”). Here is how they compare to traditional random passwords:
| Criteria | Random Password | Passphrase |
|---|---|---|
| Example | k7#mQ9$xL2!pN4w | correct-horse-battery-staple |
| Typical length | 12-20 characters | 20-40 characters |
| Entropy (typical) | 79-131 bits | 52-108 bits (4-7 words) |
| Memorability | Impossible without a manager | Moderate — mental imagery helps |
| Typing ease | Low — mixed symbols | High — regular words |
| Best for | Website accounts (stored in manager) | Master passwords, device encryption |
| NIST compliant | Yes (if 15+ chars) | Yes (if 15+ chars) |
Key insight: Passphrases trade entropy density for memorability. A 5-word random passphrase (~86 bits) is easier to remember than a 12-character random password (~79 bits) while being more secure. For maximum security, use random passwords stored in a password manager.
Common Password Mistakes
According to NordPass’s 2025 analysis of dark web data, the 10 most common passwords are:
| # | Password | Occurrences | Time to Crack |
|---|---|---|---|
| 1 | 123456 | 179.9M | Instant |
| 2 | 123456789 | 67.4M | Instant |
| 3 | 12345678 | 63.9M | Instant |
| 4 | password | 46.6M | Instant |
| 5 | 12345 | 28.3M | Instant |
| 6 | qwerty | 22.0M | Instant |
| 7 | 1234567 | 16.3M | Instant |
| 8 | 1234567890 | 15.8M | Instant |
| 9 | 111111 | 12.2M | Instant |
| 10 | qwerty123 | 12.0M | Instant |
Every one of these is cracked instantly. The top 5 password mistakes people make:
- Reusing passwords — 80-85% of people reuse passwords across multiple sites. One breach compromises all your accounts.
- Using personal information — Names, birthdays, pet names, and addresses are easily found on social media and public records.
- Keyboard patterns — “qwerty,” “asdf,” and “zxcv” are among the first combinations attackers try.
- Simple substitutions — Replacing “a” with “@” or “e” with “3” (leet speak) is well-known to crackers and adds negligible security.
- Incremental changes — Changing “Password1” to “Password2” when forced to rotate. NIST now explicitly recommends against mandatory password rotation.
Frequently Asked Questions
crypto.getRandomValues(), the browser's built-in cryptographically secure random number generator — the same API used by password managers like Bitwarden and 1Password.