Password Generator — Free Strong Random Passwords, Passphrases & PINs

Yes, safe — and no interception is possible. The generator uses crypto.getRandomValues(), the cryptographically secure random number generator built into every modern browser, using hardware entropy. No password is ever transmitted to any server — everything runs locally in your browser tab. No network request is made at all during generation. When you close the tab, the password is gone.

For standard online accounts: 14–20 characters with mixed character types (uppercase, lowercase, numbers, symbols) gives you 90–100+ bits of entropy — extremely strong against any attack. For offline secrets like a password manager master key or disk encryption passphrase: aim for 20+ characters or a 5+ word passphrase (100+ bits). The entropy meter updates live so you see the exact strength before copying.

A passphrase is several random words joined by a separator — for example "loyal-grave-swim-bear". With 4 words from a 256-word list, you get roughly 32 bits of entropy per word — over 128 bits total — which is stronger than most 12–16 character passwords. The advantage is memorability: random words stick in human memory far better than a string of random characters. Passphrases are the recommended format for master passwords you need to memorize.

Yes. When you enable multiple character types, the "Guaranteed character diversity" algorithm ensures the final password always contains at least one character from each enabled type before filling the rest randomly. You will never accidentally get a password that has no numbers or no symbols, even for long passwords where a particular type might theoretically not appear by random chance.

Entropy in bits measures how many guesses an attacker needs to crack the password. Every additional bit doubles the search space — 40 bits means about a trillion guesses; 70 bits means a sextillion. The bit count is the most accurate way to compare password strength because it accounts for both length and character set size. The crack-time estimate converts the bit count to a human-readable duration at 10 billion guesses per second — a realistic GPU-class offline attacker scenario.

Edit the symbol set field directly — remove any characters the site bans. Many sites block @, #, %, or other special characters. You can also disable symbols entirely and use a longer password with just letters and numbers to compensate for the smaller character set. The entropy meter updates live as you edit, so you can see the effect on strength immediately.

It removes characters that look visually similar in many fonts: 0 and O (zero and capital O), and 1, l, and I (one, lowercase L, capital I). Enable this when you need to write the password on paper, read it aloud, or type it on a device without copy-paste. The reduction in character set size has negligible effect on entropy at 16+ character lengths.

No. Copy history is kept only in browser memory for the current tab session — never written to localStorage, sessionStorage, cookies, IndexedDB, or sent to any server. When you close or refresh the tab, it's permanently gone. A password tool should never persist sensitive data.

Yes. Open the Bulk Generate section, choose a count (5, 10, 20, or 50 passwords), and click Generate. All passwords use your current settings. Use "Copy all" to paste the entire list into a spreadsheet, user provisioning tool, or CSV for batch account creation.