Every password you see below was generated on your device, using the same random source your browser uses for HTTPS.
Free security tool
Strong Password Generator
Cryptographically random passwords, generated in your browser. Nothing you make here is ever uploaded.
…Everything happens in your browser. This tool uses the same cryptographic random source (window.crypto) that browsers use for TLS. Nothing is transmitted, logged, or stored.
How the strength meter works
Password strength is measured in bits of entropy, which is a math estimate of how many guesses an attacker would need. Each extra bit doubles the guessing effort. A 20-character password from all four character sets (upper, lower, digits, symbols) gives roughly 128 bits of entropy, well beyond anything currently crackable. The meter turns green above 70 bits, which is the practical safe zone for online accounts today.
Passphrase entropy counts only what is actually random: each word drawn from the 1,296-word EFF short list adds about 10.3 bits, and the optional end digit adds 3.3 more. Capitalizing every word adds nothing, because an attacker can assume it, it's there purely because so many sites demand an uppercase letter. A 6-word passphrase lands near 65 bits: technically "fair" against a full offline cracking rig, but for online accounts, which lock or throttle after a handful of wrong tries, it's excellent, and far easier to type on a phone than 20 random symbols.
Password generator FAQ
How does this password generator make sure the password is really random?
It uses your browser's built-in cryptographic random number generator (window.crypto.getRandomValues), the same one browsers use for TLS and other security-critical work. Regular Math.random is not suitable for passwords because its output is predictable — this generator uses the proper API.
Are the passwords sent to a server?
No. Everything happens in your browser using JavaScript. Nothing you generate is uploaded, logged, or stored anywhere, which is exactly what you want from a password generator.
What password length should I use?
For 2026, a good rule is at least 16 characters mixing upper case, lower case, digits and symbols. That gives around 100 bits of entropy, comfortably beyond current cracking capabilities. For sensitive accounts (email, banking, password manager master password), aim for 20 characters or more.
What does the strength meter measure?
It measures entropy in bits — a mathematical estimate of how many guesses an attacker would need to try. Each extra bit doubles the guessing effort, so 80 bits is a thousand times stronger than 70. The meter turns green above 70 bits, which is the practical safe zone for most accounts.
Why exclude similar-looking characters like l, 1, I, O and 0?
They're useful when a human has to read the password off a screen and type it somewhere else, since confusing "1" with "l" or "0" with "O" is a common source of failed logins. Leave the option off if the password goes straight into a password manager — you'll get slightly higher entropy that way.
Should I use this generator or a password manager?
Both. A password manager stores and fills passwords; a generator (built-in or standalone) makes them. If your password manager has its own generator you can use that too — the security is the same as long as it uses a cryptographic RNG. This tool is useful when you need one quickly or want to check a manager's output.
What is a word passphrase and when is it better than random characters?
A passphrase strings together randomly chosen words, like Ocean-Tiger-Lamp-Acorn-Silk-Vivid-7, drawn here from the EFF's curated 1,296-word list using the same cryptographic randomness as the character mode. Each word adds about 10.3 bits of entropy. A 6-word passphrase is comparable in strength to a 10-11 character fully random password, but far easier to remember and to type on a phone. Use a passphrase for anything you type by hand (master password, computer login, Wi-Fi); use random characters for anything a password manager fills for you.
Free password generator by ANUPRESS
Why “random” turns out to matter so much
A password isn’t strong because it looks strong. It’s strong because an attacker can’t guess it faster than trying every possibility one by one. That’s why the source of the randomness matters. This tool uses window.crypto.getRandomValues, the browser’s cryptographically secure random API, the same one used behind the scenes for TLS handshakes and WebAuthn. Simpler generators that rely on Math.random can be predicted from a few outputs. The difference is invisible to the user, but very visible to anyone trying to break the password.
What length is actually enough in 2026
Sixteen characters mixing all four sets (upper, lower, digits, symbols) gives around 104 bits of entropy, which is well beyond current cracking capacity. Twenty is a comfortable default and what this tool starts at. Anything above 24 is overkill for a password you’ll type by hand, but perfectly fine when the password manager handles it. For your master password (the one that unlocks everything else), longer is better and a passphrase of unrelated words is often easier to remember than a 20-character string of gibberish.
When to exclude similar-looking characters
The “exclude similar” option strips out l, 1, I, O and 0 because they’re the most commonly misread when a person types a password from a screen or a printed sheet. Turn it on if the password is going onto paper or a device where you’ll have to type it by eye. Leave it off if the password is going straight into a password manager and no human has to read it, because you’ll get a slightly bigger alphabet and slightly more entropy per character.
This tool is not a replacement for a password manager
A password manager stores and autofills your passwords across every site. This tool makes new ones. Both fit in the same workflow: generate a password here, paste it into your manager (or the site’s signup form), and never see it again. If your manager already includes a generator you can use that instead, since the security is identical as long as it uses a cryptographic random source. Some people prefer a standalone tool for quick one-off cases, or to sanity-check that their manager’s output looks similar to what a known-good generator produces.