Password Generator
Random passwords, memorable word passphrases and PINs. Choose your settings, then generate locally in your browser.
No account. No saved results. No generated values sent to a server.
Choose how to generate
Short lengths and restricted alphabets may be weak. Default random length is 20; your destination may impose different limits. No settings are silently strengthened or truncated.
Your generated results
No results yet. Generate when you are ready.
Results are visible by default. Hide them when others can see your screen; hiding is not encryption.
Copying may leave secrets in clipboard managers or OS sync. TXT downloads are plaintext secrets; save only when you intend to keep a file. Clear does not erase clipboard contents or downloaded files.
Settings for these results
How this generator works
Web Crypto supplies cryptographically generated unsigned 32-bit values. For an alphabet of n characters, only draws below floor(2³² ÷ n) × n are accepted; the accepted draw modulo n selects a character. No Math.random or server fallback is used. Character requirements reject complete candidates. No-repeat samples from a shrinking pool. Generation stops rather than weakening a policy when retries fail.
Unrestricted random bits = length × log₂(alphabet size); PIN bits = length × log₂(10). Passphrase selection bits = words × log₂(7,776), plus log₂(10) for an optional digit and 3 for an optional symbol. A fixed separator or capitalization adds no bits. Word sequences can render identically when separators are absent or appear inside words, so selection bits do not claim an exact unique output-string count. Constrained password bits are unavailable. No crack-time forecast or guaranteed strength is offered.
Public examples only, never use these as credentials: a four-digit PIN may be 0012; fixture words alpha, beta and gamma with title case and a space separator become Alpha Beta Gamma. Real passphrases use the full reviewed list.
EFF wordlist and privacy
The complete EFF long wordlist by EFF / Joseph Bonneau is attributed under CC BY 4.0 under the EFF copyright policy. The original bytes are checked by SHA-256 and list invariants; four hyphenated entries are preserved. The list loads as a static same-origin asset only when needed. After assets load, generation needs no network; first-load offline access is not promised. No generated result, setting or exclusion is stored by this tool or placed in requests, logs or URLs. Explicitly copied or downloaded values leave this page’s control.
NIST SP 800-63B-4 gives verifier guidance: at least 15 characters for single-factor use, at least 8 characters when used only with MFA, and acceptance of at least 64 characters is recommended. It does not require character mixtures or routine changes without compromise. These are verifier rules, not generator certification or a promise that every destination accepts these settings.
Browser compromise, injected scripts, extensions and malware remain risks. Use a trusted password manager and unique credentials, and consider MFA/passkeys supported by the service. See Web Crypto, EFF’s method and NIST SP 800-63B-4 (verifier guidance, not generator certification). Reviewed 16 October 2026.
Password generator questions
Are generated passwords saved or sent anywhere?
Generation runs in your browser with no generated values sent to a server or saved in browser storage. Copy and TXT download are explicit actions. Clipboard managers, operating-system sync, extensions and malware are outside this page’s guarantees. Site analytics measures visits, not generator inputs or outputs.
What makes the random choices unbiased?
Web Crypto supplies unsigned 32-bit random values. Values in an incomplete tail are rejected before choosing an alphabet index. Required character counts reject a whole candidate, rather than patching characters into it. Generation stops with an error if randomness or bounded retries fail.
What does the bits figure mean?
It describes theoretical uniform output choices for unrestricted character passwords and PINs, or random word selections for passphrases. Constraints make the password estimate unavailable here. Separators and capitalization add no random bits. These figures are not crack-time predictions or security certification.
Can a passphrase repeat a word or a PIN contain a sequence?
Yes. Independent uniform choices can repeat and can produce patterns. No-repeat and start-with-letter are optional random-password compatibility controls. They do not apply to passphrases or PINs. Short PINs depend on the destination’s attempt limits and are not unrestricted account passwords.
Should I change a password every month?
Current NIST guidance for password verifiers does not call for routine changes without evidence of compromise, or mandatory character mixtures. Use a unique credential per account, a trusted password manager and MFA or passkeys where supported. The destination’s compatibility rules still apply.
Updated