Generate secure passwords, memorable passphrases, pronounceable passwords and PINs, or test your own password for weak patterns, real crack time and data-breach exposure. Runs in your browser.
Create cryptographically random passwords up to 128 characters, word-based passphrases, pronounceable passwords or pattern-free PINs, in bulk if you need them. The strength checker looks for dictionary words, l33t swaps, dates, keyboard runs and leaked passwords, shows crack time for four real attack types, and can check Have I Been Pwned without sending your password.
Create random, high-entropy passwords with control over length and character sets, then check any password's strength against length, variety, and common-pattern weaknesses. It's two essential security tasks, creation and evaluation, in one place.
Features
4 generators: random password, passphrase, pronounceable and PIN
Crack time for online, offline slow-hash and GPU fast-hash attacks
Private breach check via Have I Been Pwned k-anonymity
Bulk generate up to 100 passwords and download as .txt
Custom symbols, excluded characters, minimum digits/symbols, no look-alikes
Nothing is stored or sent; session history stays in memory
How to use Password Generator
1
Choose a generator
Pick Password, Passphrase, Pronounceable or PIN. Settings regenerate the result instantly.
2
Set the rules
Set the length or word count, character sets, allowed symbols, minimum numbers and symbols, and characters to avoid.
3
Copy or generate in bulk
Copy the password, or create a list of 5 to 100 unique passwords and download them.
4
Check an existing password
Open Check strength, type a password and see which parts are guessable, the crack time for each attack type and tips to fix it.
5
Look it up in breach data
Optionally run the Have I Been Pwned check. Only five characters of a SHA-1 hash leave your browser.
Common use cases
Creating a unique, strong password for a new online account
Generating memorable passphrases for logins you type by hand
Producing numeric PINs for devices, cards, or app locks
Auditing an existing password's strength before reusing it
Making Wi-Fi or router admin passwords that resist brute force
Generating credentials for shared team or service accounts
Detailed guide
Privacy-first by design
Passwords are generated and analyzed entirely in your browser and are never transmitted or stored, so nothing you type is logged. Pair a unique generated password with a password manager for each account to shut down credential-stuffing and reuse attacks.
Frequently asked questions
How does the password strength checker work?
It scans for dictionary words, common passwords, letter-to-number swaps like p@ssw0rd, years and dates, keyboard runs like qwerty and repeated characters, then estimates entropy from what is left. That is why Password2024! scores far lower than its length suggests.
Is the Have I Been Pwned check safe?
Yes. Your password is hashed with SHA-1 in the browser and only the first 5 characters of the hash are sent. The service returns hundreds of matching hashes and the comparison happens on your device (k-anonymity).
What is a pronounceable password?
A password built from consonant-vowel syllables such as Tavomikez42. It is easy to read aloud or type on a phone, but carries fewer bits per character, so use at least 5 syllables.
Can I generate many passwords at once?
Yes. Bulk generate creates up to 100 unique passwords with your current settings, which you can copy or download as a text file.
How do I create a strong password?
A strong password should be: at least 12 characters long, include uppercase and lowercase letters, numbers, and symbols, and not contain dictionary words or personal info. This generator creates cryptographically random passwords following all these rules.
What makes a password secure?
Password security comes from entropy (randomness). A 16-character password using letters, numbers, and symbols has over 95^16 possible combinations, taking billions of years to crack by brute force with current computers.
How long should my password be?
Minimum 12 characters for personal accounts, 16+ for financial and work accounts. Longer is always better. A 12-character complex password takes centuries to crack; a 6-character password can be cracked in minutes.
Does this password generator store my passwords?
No. All password generation runs locally in your browser's memory. The generated passwords are never sent to any server, logged, or stored anywhere. When you close the page, the passwords are gone.
Is using a password manager better than remembering passwords?
Yes. Password managers let you use a unique, strong password for every site without memorizing them. This is far safer than reusing the same password, if one site is breached, your other accounts stay safe.
How do I check if my current password is strong?
Open the Check strength tab and type or paste it. The checker highlights guessable parts (words, dates, sequences), shows the effective entropy in bits, a rating from Very weak to Very strong, and crack times for four attack types.
What is a passphrase and is it more secure?
A passphrase strings together random words (like 'Cable-River-Oak-Mint-42'). It's easier to remember and type than a random string, and a 5-6 word passphrase can exceed 70 bits of entropy, stronger than most manually-created passwords, while staying human-friendly.
What does entropy in bits mean?
Entropy measures unpredictability. Each bit doubles the number of guesses an attacker must make. 40 bits is weak, 60-70 bits is good, and 80+ bits is effectively uncrackable with today's hardware. This tool shows the exact bit count for whatever you generate or type.
Should I exclude look-alike characters?
Enable 'No look-alikes' when a password will be typed or read aloud, it removes easily confused characters (O vs 0, l vs 1, I). It slightly lowers entropy per character, so bump the length up a little to compensate. For manager-stored passwords you can leave it off.
How long would it take to crack my password?
The strength checker estimates crack time from the password's length and character variety, so you can see the difference a longer, more varied password makes. The estimate is calculated in your browser and nothing you type is sent anywhere.
What makes a strong password in 2026?
Length matters most: aim for 16 or more characters mixing upper- and lower-case letters, numbers and symbols, and make it unique per account. A long passphrase of random words is both strong and easier to remember.
Is the password generated privately, or sent to a server?
It is generated entirely in your browser using a secure random source and is never transmitted, logged or stored, so it is safe to create passwords for real accounts here.
Does this store my passwords?
No. Generation and strength checking happen entirely in your browser; nothing is saved or transmitted.
How long should a password be?
Aim for at least 12-16 characters. Length adds more security than complexity, so longer passphrases are both stronger and easier to remember.
