Contact

Tools  /  Security  /  Password Generator

SECURITY

Password Generator

Strong random passwords, passphrases and PINs, with a real entropy figure, QR export and bulk generation.

More Security tools

Password Strength Checker Passphrase Generator Certificate / DER Structure Viewer PEM Formatter PEM Decoder Public Key Format Checker

What this tool does

Generates cryptographically random passwords, passphrases, or numeric PINs, with a real entropy figure (not a cosmetic strength bar) and an estimated brute-force time alongside every result. Beyond the basics, it guarantees every character type you select actually appears in the password (not just "likely"), lets you exclude specific characters, generates passwords in bulk for exporting to a password manager, shows the current value as a QR code for transferring it to another device without typing it, and keeps a session-only history so you can get back to one you generated a moment ago.

Password vs. passphrase vs. PIN

A password (random characters) packs the most entropy per character, which is why it's still the default for most accounts. A passphrase (several random dictionary words, like Coral-Finch-Harbor-42) trades character density for memorability — it's genuinely easier to type and recall correctly, especially somewhere you can't use a password manager, and at 5-6 words it can carry comparable entropy to a 16-character random password. A PIN is for contexts that only accept digits, like a device lock screen — it has far less entropy per digit, so a short PIN should only protect something with a limited-attempt lockout, never an account with unlimited login tries.

What "entropy" actually means here

The bits of entropy shown is log2(pool size) × length for a password, log2(word list size) × word count for a passphrase — the real, textbook definition, not a marketing score. More bits means more possible combinations an attacker would have to try; the brute-force estimate converts that into a rough time figure assuming 100 billion guesses per second, a realistic ballpark for an offline attack against a fast, unsalted hash. A properly salted, slow hash (bcrypt, Argon2, scrypt) makes real-world cracking far slower than this number suggests — the figure is for comparing options against each other, not a literal guarantee.

Guaranteed character coverage, QR export, and bulk generation

Turning on uppercase, numbers, and symbols doesn't just make them possible in the result — this generator checks the output and guarantees at least one character from every type you selected actually appears, which matters because some sites and systems reject a password missing a required character class. The QR code option renders the current value as a scannable code, a quick way to move a freshly generated password to a phone without typing it or sending it anywhere. Bulk generation produces up to 100 at once for seeding a password manager or setting up test accounts, downloadable as a single text file.

Privacy

Every password is generated with crypto.getRandomValues — a cryptographically secure random source, not Math.random — entirely in your browser. Nothing is sent to a server. The session history exists only in this tab's memory; it is never written to disk or localStorage, and it disappears the moment you leave or reload the page.

FAQ

Frequently asked questions

Is this actually random, or just random-looking?
It uses crypto.getRandomValues(), the Web Crypto API's cryptographically secure random number generator — the same class of randomness used for real cryptographic keys, not Math.random() (which is not safe for anything security-related).
Are my generated passwords uploaded or stored anywhere?
No. Generation happens entirely in your browser. The session history is kept only in this tab's memory — it's never written to localStorage or sent anywhere, and it's gone as soon as you reload or close the page.
Does it guarantee my password includes a symbol/number if I turned that on?
Yes — after generating, the tool checks that at least one character from every type you selected (uppercase, lowercase, numbers, symbols) is actually present, and fixes it if not, rather than leaving it to chance.
Should I use a password or a passphrase?
Either is strong if it's long enough and genuinely random. A passphrase (several random words) is usually easier to type correctly and remember without a manager; a character password packs more entropy per character typed. Check the bits-of-entropy figure for either to compare them directly.
What is a PIN mode password actually good for?
Digits-only unlock codes — device lock screens, SIM PINs, door codes — where only numbers are accepted. A PIN has far less entropy than a password of the same length, so only use a short PIN where attempts are rate-limited or locked out after a few tries.
What does the brute-force time estimate assume?
It assumes 100 billion guesses per second against an offline, unsalted, fast hash — a realistic worst case for comparing options. A properly salted slow hash (bcrypt, Argon2, scrypt) makes real cracking far slower; the number here is for comparing choices, not a literal guarantee either way.
Can I generate many passwords at once?
Yes — set the bulk count (up to 100) and generate a full batch in one click, each individually copyable or downloadable together as a text file, useful for seeding a password manager or setting up multiple test accounts.
Theme Accent