Password Generator
Generate a random password, memorable passphrase, or PIN using browser cryptography, with options for length, character types, and readability.
Generated in your browser. Passwords are never sent or stored.
Word list: EFF Diceware long list, 7,776 words, CC BY 4.0.
Entropy labels: Weak <40 bits; Fair 40–59; Strong 60–79; Very strong 80+.
What is the password generator?
A password generator creates credentials from cryptographically secure random values instead of predictable words, dates, or reused patterns. This tool can produce a random character password, a multiword passphrase from the bundled EFF Diceware list, or a numeric PIN. Choose the format and its options, then generate a new value whenever you need a unique credential.
How it works
The browser's Web Crypto API supplies random values. Rejection sampling maps them to characters, words, and digits without modulo bias; random passwords include at least one character from each enabled type and are then shuffled. Passphrases select words independently from the local 7,776-word EFF list. The displayed strength is an estimate based on the selected output length and pool, not a guarantee that an account is secure.
Worked example
For a 16-character password with lowercase, uppercase, numbers, and symbols enabled, the generator selects at least one character from each chosen type, fills the remaining positions from their combined pool, and securely shuffles the result. If you need something easier to type, switch to passphrase mode and choose five or more randomly selected words with a separator.
How strong should my password be?
For randomly generated passwords, length usually adds more protection than trying to satisfy a long list of composition rules. Use a different password for every account and let a password manager create and store long values so you do not have to memorize them all.
- Everyday accounts: aim for at least 16 random characters, or a memorable passphrase of six or more randomly selected words.
- Email, financial, and administrator accounts: choose a longer unique password or passphrase and protect the account with multi-factor authentication.
- Device or app PINs: use the longest length the device allows, avoid predictable patterns, and enable device-level lockout protections.
Add multi-factor authentication when the service supports it, especially for email, financial, work, and administrator accounts. It adds a separate proof of identity, so a stolen password alone may not be enough to sign in. Change a password promptly if it may have been exposed; routine forced changes can encourage predictable variations.
Random password vs passphrase vs PIN
| Type | Best fit | How strength grows | Keep in mind |
|---|---|---|---|
| Random password | Online accounts saved in a password manager | Character count and the enabled character pool | Hard to memorize; never reuse it |
| Passphrase | A password you need to type or remember | Number of independently selected words | Use random words, not a familiar quote |
| PIN | A device or local app lock | Number of digits | Use device lockout; avoid predictable runs |
How this generator works
The browser uses crypto.getRandomValues to obtain random 32-bit values. It uses rejection sampling before converting those values into character, word, or digit indexes, avoiding modulo bias. Random passwords include at least one character from every enabled type and are then shuffled with a cryptographic Fisher–Yates shuffle. Passphrases use the bundled EFF Diceware long list; no word list is fetched. The generator does not send or save generated values, and the settings are not persisted. Entropy is an estimate based on the selected pool and output length; it does not guarantee that an account or device is secure.
The passphrase list contains 7,776 entries from the Electronic Frontier Foundation’s Diceware long word list. The original list is available at eff.org and is reused under CC BY 4.0 with attribution.
Frequently asked questions
Are generated passwords sent to a server?
No. Generation runs in your browser, the word list is bundled with the page, and generated values are not uploaded or saved by this tool.
How does the generator create random values?
It uses the browser's Web Crypto API and rejection sampling to select characters, words, and digits without modulo bias.
How long should a password be?
Use a unique password at least 16 characters long where the service allows it, or a passphrase of six or more randomly selected words. A password manager can store long passwords for you.
What is the difference between a password and a passphrase?
A random password combines characters from selected sets; a passphrase combines independently chosen words. A longer passphrase can be easier to type, while a password manager is useful for storing either kind.
What does the PIN option do?
It creates a numeric code from 4 to 12 digits. You can ask it to reject repeated digits and simple ascending or descending runs; use the longest length your device allows.
Can a password generator guarantee my account is secure?
No. A strong unique credential helps, but account security also depends on the service, protecting your device, and enabling multi-factor authentication when available.
Where does the passphrase word list come from?
Passphrases use the EFF Diceware long word list, bundled locally and reused under CC BY 4.0 with attribution.
What does the strength label mean?
It is an estimate derived from the selected output length and character pool. It does not account for every real-world risk and is not a guarantee of security.
Related tools
- JSON Formatter & Validator Beautify, minify and validate JSON with clear error messages — nothing is uploaded.
- HTML Editor Edit HTML source and see the rendered page update as you type, with a sandboxed preview that blocks scripts and remote resources.
- Base64 Encode & Decode Encode and decode Base64 for text and files, with URL-safe mode — privately in your browser.
- JSON to CSV Converter Convert structured JSON into spreadsheet-ready CSV without uploading files or leaving your browser.
- CSV to JSON Converter Turn spreadsheet data into clean JSON arrays or keyed objects without sending files to a server.
- JSON to XML Converter Create clean XML from nested JSON while keeping your data private and local to the browser.
- JSON to YAML Converter Convert structured JSON into readable YAML for config files, deployment manifests, and developer tooling.
- Regex Find & Replace Tool Test regular expressions with live match highlighting, then find and replace text using capture groups — privately, in your browser.