How does this password generator work?
A strong password is one an attacker cannot guess, and the only reliable way to achieve that is randomness. This generator draws every character or word from your browser’s cryptographically secure random number generator (crypto.getRandomValues()), using rejection sampling so that every option is exactly equally likely. When you require each character type, it keeps drawing until a password contains all of them, rather than forcing them into predictable positions.
Passphrase mode strings together random words, like orbit-maple-tango-crisp-velvet. Each word from the built-in list of about 1,450 words adds roughly 10.5 bits of entropy, so five words give about 52 bits and seven words about 73 bits — easier to type and remember than the equivalent jumble of symbols.
Everything runs locally. Passwords are never saved, logged or sent to a server; only your settings (length, character types) are remembered in your browser. For important accounts, store generated passwords in a password manager and turn on two-factor authentication.
How to use the Password Generator
- Choose Random characters for maximum strength per character, or Passphrase for something you can remember and type.
- Adjust the length or number of words and the character options. New passwords appear instantly.
- Check the strength meter: aim for at least 60 bits for normal accounts and 80+ bits for password managers, email and admin logins.
- Copy a single password or all of them, then save it in your password manager.
Example
Typical output and its entropy:
20 random characters, all types: k#9Vq!T2m$Lx7@pR4wZe (≈131 bits)
16 characters, letters and digits: 8fKq2WmZ7xR4vT9b (≈95 bits)
6-word passphrase: lantern-quiz-ember-sloth-pixel-harbor (≈63 bits)What makes a password strong?
- Length beats complexity. Each extra character multiplies the search space; a 20-character lowercase password is stronger than an 8-character one with symbols.
- Real randomness. Human-chosen patterns (
Summer2026!) are the first things cracking tools try, whatever their length. - Uniqueness. A reused password is only as safe as the weakest site that stores it. Use a different one everywhere.
- Good storage on the server. Sites should hash passwords with a slow algorithm such as Argon2id or bcrypt — see the Hash Generator for why fast hashes like MD5 and SHA-1 are unsuitable.
Passwords in WordPress
WordPress hashes user passwords with bcrypt since version 6.8 (earlier versions used phpass with salted MD5 iterations). Use a long generated password for every administrator, never reuse the hosting or database password, and enable two-factor authentication with a plugin. The WordPress Launch Checklist covers the other security basics.
Frequently Asked Questions
Is it safe to generate a password online?
With this tool, yes: the password is created by JavaScript in your browser using the operating system’s secure random source and is never transmitted or stored. You can even disconnect from the internet after the page loads and it will keep working.
How long should my password be?
With all character types, 16 characters (about 100 bits) is plenty for almost any account, and 20+ is excellent. For a passphrase, use at least 5 words, or 6–7 for a password manager master password.
How accurate is the crack-time estimate?
It assumes a well-funded offline attack and that the attacker knows your settings, then calculates how long it takes to try half of all possible passwords. Real-world times depend on how the site stores passwords, so treat the numbers as an order of magnitude — the entropy figure is the exact measure.
Why use a passphrase instead of random characters?
Passphrases are much easier to remember and type — for example on a TV or phone — while still being strong if the words are chosen randomly. Choose random characters when a password manager will fill it in for you.
Should I exclude similar or ambiguous characters?
Only if you will read or type the password by hand. Excluding characters slightly reduces entropy per character, which the strength meter accounts for; add a character or two to compensate.