Password Generator
Generate a strong password — fully random, easy-to-pronounce, or a numeric PIN — with full control over length and character classes, all in your browser.
Choose at least one character type.
{{ g.value }}
{{ g.strength.label }}
{{ strength.label }} — {{ strength.entropyBits }} bits of entropy
- {{ f }}
Estimated time to crack
A mathematical estimate assuming pure random guessing against this exact password — it cannot detect a password reused elsewhere, or one guessable from your name, birthday, or other personal information.
Nothing is sent anywhere — this runs entirely in your browser.
Check against a specific password policy
- {{ c.label }}
Every password is generated in your browser using crypto.getRandomValues. Nothing is ever sent to a server.
How randomness works here
Every character, syllable and digit comes from crypto.getRandomValues() — the
same cryptographically secure randomness source browsers use to generate encryption keys —
rather than Math.random(), which is fast but explicitly not designed to be
unpredictable. A rejection-sampling step also removes the small bias a naive "random byte
modulo pool size" approach would otherwise introduce for most pool sizes.
Random, pronounceable, or PIN — which should you pick?
Fully random is the strongest option character-for-character, and the right choice whenever you'll store the result in a password manager rather than typing it yourself. Pronounceable passwords alternate consonant and vowel syllables — readable and typeable, still strong at a reasonable length. PINs are numeric-only, for the places that only accept digits.
Want to check a password you already have instead?
Use the Password Strength Checker — entropy scoring, specific weaknesses, and estimated crack time.
Frequently asked questions
How random are these passwords?
Every character comes from crypto.getRandomValues, the same cryptographically secure randomness source browsers use for encryption keys — never Math.random(), which is fast but not designed to be unpredictable. A rejection-sampling step also removes the small bias a naive "random byte modulo pool size" approach would introduce for most pool sizes.
What is a pronounceable password, and is it as strong as a random one?
It alternates consonant and vowel syllables — like "Kimodavu42" — so it is far easier to read and type correctly than a fully random string of the same length. Character-for-character it carries less entropy than pure random output, but at a reasonable length it is still comfortably strong, and a password you can actually type without three attempts has real value too.
Should I exclude ambiguous characters?
Turn it on if you might need to type the password by hand, especially from a printed copy or read aloud — it drops characters that are easy to confuse, like the digit 1, the letter l, and the letter I. Leave it off if you will only ever copy and paste, since it slightly shrinks the character pool.
Are generated passwords stored or sent anywhere?
No. Generation happens entirely in your browser. Nothing is transmitted to a server, written to local storage, or kept after you leave or reload the page.
How long should my password be?
At least 12-16 characters for anything protecting real value, and longer for a passphrase-style password. Length matters more than complexity rules — a longer password with fewer restrictions usually beats a short one forced through every character class.
What is the PIN generator for?
Purely numeric codes — device unlock codes, safe combinations, anywhere only digits are accepted. It uses the same secure random picker as the character-based generator, just drawing from a 10-digit pool instead.