A free, cryptographically secure password generator that runs entirely in your browser. Pick a length, choose character sets, and get a random password with a live strength estimate — or switch to passphrase mode for a memorable “correct-horse-battery-staple” style phrase. Randomness comes from your browser’s built-in crypto engine, and nothing you generate is ever sent anywhere.
Password options
Need a few at once?
🔒 Passwords are generated in your browser and never sent anywhere. This page makes no network request when you generate or copy — you can even load it, go offline, and keep generating.
How to use this password generator
Set the length with the slider (16+ recommended), tick the character sets you want — uppercase, lowercase, numbers, symbols — and the tool instantly produces a random password. Hit Regenerate until you see one you like, then Copy it straight into your password manager. If a site rejects symbols, untick that box; if you hate squinting at 0-vs-O and l-vs-1, enable Exclude ambiguous. Prefer something you can actually remember or read out loud? Switch to Passphrase mode for a random-word phrase like correct-horse-battery-staple, with your choice of word count and separator.
What makes a strong password
Strength comes down to entropy — how many equally likely possibilities an attacker must try. This tool estimates it as length × log₂(pool size): a 16-character password drawn from all four character sets (a pool of 85 symbols) carries roughly 100+ bits of entropy, far beyond realistic brute-force range. Three practical rules follow from the math:
- Length beats complexity. Every extra character multiplies the search space; adding one symbol to the pool barely moves it. A 20-character letters-only password is stronger than a 10-character everything password.
- Random beats clever. Human patterns (words, dates, keyboard walks, "P@ssw0rd!" substitutions) collapse the search space. Cryptographic randomness — what this tool uses — does not.
- Unique beats strong. Even a perfect password is a liability if reused: one breached site exposes every account sharing it. Generate a fresh one per account and store them in a password manager.
Passphrases trade per-character entropy for memorability: with this tool's built-in list of about 220 common words, each word adds roughly 7.8 bits, so a 5-word phrase lands near 39 bits — fine for a device unlock you must type from memory, but pick 7+ words (or a random password) for anything critical. The strength meter shows this honestly rather than flattering you.
Frequently asked questions
Is this password generator safe and private?
Yes. Everything runs locally in your browser — no password, keystroke, or setting is transmitted, logged, or stored on any server. You can verify this: open your browser's network tab and generate away; no requests fire. For maximum caution, load the page, disconnect from the internet, and generate offline.
Are these passwords truly random?
They use crypto.getRandomValues, your browser's cryptographically secure random number generator (CSPRNG) — the same class of randomness used for encryption keys — not the predictable Math.random() many simple generators rely on. The tool also applies rejection sampling to avoid modulo bias, so every character in the pool is equally likely.
Should I use a password or a passphrase?
Use a long random password (16+ characters, all sets) for anything stored in a password manager — you never type it, so memorability is irrelevant. Use a passphrase where a human must remember or type it: your master password, device login, or Wi-Fi key. Because this tool's word list is small, use 7 or more words for high-value passphrases.
Is this tool free?
Completely free — no signup, no limits, no ads harvesting your data. It is a static page that works in any modern browser, part of the free GeoParrot tools collection.
More free tools
Browse the full set of free GeoParrot tools, including our word and character counter for checking text length, reading time, and readability.