Online Password Generator - Random Strong Passwords & Passphrases
Random strong passwords / batch generation
Passphrase Generator (memorable & secure)
Joins several random English words — far easier to remember than a string of gibberish, yet just as strong with enough words. Great as a master password, password-manager unlock code, or for spoken/handwritten use.
Password Strength & Entropy Reference
Strength is determined by "length × character-set size" and measured in bits of entropy. The table below is estimated for an uppercase+lowercase+digit+symbol set (about 94 printable characters):
| Length | Approx. combinations | Entropy | Security level |
|---|---|---|---|
| 8 chars | ≈10¹⁵ | ≈52 bits | Weak |
| 12 chars | ≈10²³ | ≈79 bits | Medium |
| 16 chars | ≈10³¹ | ≈105 bits | Strong |
| 20 chars | ≈10³⁹ | ≈131 bits | Very strong |
Each few extra characters push cracking difficulty up exponentially. This tool generates 16 characters by default, supports up to 1024, and uses cryptographically secure randomness throughout. Verify the real entropy afterwards with the Password Strength Checker.
What is a strong password & how to generate one
A strong password usually contains upper/lowercase letters, digits and special symbols and is at least 12 characters long. This tool uses the cryptographically secure random generator (crypto.getRandomValues), not predictable Math.random(), so every password is genuinely random and unpredictable. After generating, verify security with the Password Strength Checker. Enterprises that need a uniform policy can batch-generate compliant random passwords here and use a UUID Generator for unique system identifiers. For coding work, the Base64 Encoder/Decoder helps encode sensitive credentials at rest.
Under the hood: crypto.getRandomValues vs Math.random
Math.random() uses a pseudo-random number generator (PRNG) whose seed depends on predictable factors like the current time — unsuitable for security. crypto.getRandomValues() draws true random seeds from the operating system's low-level entropy sources (hardware noise, user-input timing) and meets cryptographic-security standards. Every password here is generated with crypto.getRandomValues, guaranteeing: (1) each password is unpredictable; (2) two runs never produce the same sequence; (3) even an attacker who knows the algorithm cannot reconstruct generated passwords. All data lives only in browser memory and is destroyed on refresh or tab close.
What is a passphrase (diceware)?
A passphrase stitches a few random English words into a readable phrase, e.g. "river-cloud-tiger-music". Its advantage: human memory is far better at "a handful of words" than "a pile of gibberish symbols", yet with enough words it still reaches high entropy. The security community (the xkcd 936 paradigm and the diceware method) widely recommends it for master passwords or password-manager unlock codes — scenarios that value "memorable and long" over "contains special symbols".
The generator above produces passphrases: choose the word count (4 words ≈ 29 bits by default; 6 words ≈ 44 bits) and a separator, then one click. For higher strength, append a digit or symbol at the end, or push the word count past 8. Note that passphrase entropy comes from "wordlist size × word count", so use a cryptographically secure generator like this one instead of "inventing" words yourself — human-invented words are typically predictable.
How to generate a secure password with this tool
Drag the length slider to set the size (16+ recommended), tick the character types to include (uppercase, lowercase, digits, symbols), and optionally click the symbol buttons to customize the allowed special characters. Type characters you want to exclude into the "Exclude ambiguous characters" field (e.g. 0OIl1), choose how many to generate at once, and click "Generate Passwords" to produce batch strong passwords you can copy one by one or all at once.
How to set passwords for different scenarios
Before generating, think about "where it's used": who uses it (a human or a machine), where it's typed (keyboard or a TV remote), and how serious a leak would be — these decide length and character mix. The table below lists recommended configs for common scenarios:
| Scenario | Recommended length | Character mix | Notes |
|---|---|---|---|
| WiFi password | 16-20 chars | letters + digits | TVs/IoT devices handle symbols poorly |
| Website / app login | 16+ chars | upper+lower+digits+symbols | Unique per account, never reused |
| Server / SSH | 20-32 chars | upper+lower+digits+symbols | Prefer key-based auth, password as fallback |
| Database / middleware | 24-32 chars | upper+lower+digits+symbols | Stored in config files, no need to memorize |
| API keys | 32+ chars | letters + digits | Machine-only, longer is better |
How to generate a WiFi password, and how long should it be?
WPA2/WPA3 pre-shared keys allow 8-63 characters; 16-20 alphanumeric characters is plenty to keep freeloaders out. Untick "symbols" when generating: entering special symbols with a TV remote or on smart devices is painful, and some older devices encode them inconsistently, leading to "my password is right but I still can't connect". Tick upper/lowercase + digits, set the length to 16-20, generate, and paste into your router console.
How long should a server / SSH password be?
Servers sit directly on the public internet and are prime targets for brute-force and dictionary attacks — use 20-32 characters with all four classes. The bigger practice is: prefer key-based SSH auth (e.g. ed25519) and treat the password as a console fallback; also disable direct root login and add rate limiting with something like fail2ban. Generate 32-character passwords here and batch-produce several sets for root and ordinary ops accounts.
What's the difference between an API key and a password?
A password authenticates a human and must balance memorability with input. An API key authenticates a machine and is carried by code, so it doesn't need to be memorable. Therefore API keys can and should be longer — 32+ characters — and typically need no symbols (most services allow only alphanumerics). In production, keys are usually issued by the provider; if you need random credentials for an internal system, generate 32 alphanumeric characters here or use a UUID Generator for globally unique ids. How much damage a leaked key does depends on its permissions — use least-privilege and rotate regularly.
How do I use generated passwords on my phone?
Open this tool in a mobile browser and generation still happens locally (it doesn't depend on a desktop environment). Long-press to copy, then paste into the signup page. The smoother route is pairing with a password-manager app (Bitwarden, 1Password, etc.): generate on your computer and save straight into the manager, and your phone autofills from sync — no more typing long passwords on a tiny keypad. iOS and Android clipboards auto-clear after a while, so paste worries about lingering traces are minimal.
Why you shouldn't invent your own passwords
"123456", "password", birthday plus pinyin name — "human-invented" passwords top the most-common lists of leaked databases year after year. Dictionary attacks exploit exactly this: attackers build a dictionary from hundreds of millions of real leaked passwords, then permute your social details (birthday, name, phone number). A typical "self-made" password is broken in seconds — it looks complex but has zero randomness. Truly secure passwords must come from cryptographically secure randomness: no patterns, no bias, unpredictable. That's why this tool uses crypto.getRandomValues. Curious how weak your current password is? Run it through the Password Strength Checker.
Password Security FAQ
How many characters should a strong password have?
At least 12 characters for general accounts, and 16+ for important ones. The longer the password, the more time a brute-force attack needs — it grows exponentially. This tool defaults to 16 characters and supports up to 1024.
Are generated passwords saved or leaked?
No. All passwords are generated locally in your browser using the cryptographically secure crypto.getRandomValues (not Math.random). Nothing is uploaded or stored, and no password ever leaves your device.
Why include uppercase, lowercase, numbers and symbols?
More character types mean many more possible combinations. A 16-character lowercase-only password has roughly 4×10²² combinations; adding uppercase, digits and symbols raises that to 10³²+ — dramatically harder to crack.
What are ambiguous characters and why exclude them?
Ambiguous characters look similar, such as the digit 0 vs the letter O, or the digit 1 vs the letter l. When typing by hand these are easy to confuse. Excluding them avoids typos when you manually enter the password.
What if I can't remember a random password?
Use a password manager (e.g. Bitwarden, 1Password) to store and autofill them. You can also save generated passwords in an encrypted note — just never reuse the same password across multiple accounts.
What should an enterprise password policy look like?
Require at least 12 characters and at least three of the four classes (uppercase, lowercase, digits, symbols). Recommend rotating every 90 days, use this tool to batch-generate compliant random passwords for employees, and verify their quality with a password strength checker.
What is the risk of reusing the same password on many sites?
Very high. When one site leaks, attackers try that leaked password on your other accounts (credential stuffing). Use a unique random password per important site — this tool can batch-generate many mutually-different strong passwords so each account gets independent protection.
How often should I change my passwords?
Every 3–6 months for ordinary personal accounts; every 90 days plus two-factor authentication for accounts involving money or sensitive data (banking, email, the password manager itself). More important than frequency is "never reuse the same password" — rotate unique strong passwords per account. To quantify strength, verify entropy with a password strength checker.
What is a passphrase and is it easier to remember than random passwords?
A passphrase (a.k.a. passphrase-style / diceware) joins several random English words with hyphens or spaces, e.g. "river-cloud-tiger-music". It turns a long unreadable random string into a few readable words, sharply cutting the memory burden while staying just as strong when enough words are used. This tool generates passphrases: pick the word count and separator, click once. Great as a master password, a password-manager unlock code, or for spoken/handwritten use.
What security standard do generated passwords meet?
This tool uses the browser's cryptographically secure crypto.getRandomValues — not a predictable PRNG. The default 16 characters cover uppercase, lowercase, digits and symbols, matching NIST SP 800-63B and the OWASP Authentication Cheat Sheet for "long enough and unpredictable". Everything runs locally: nothing is uploaded, stored, or transmitted, so it's safe to use for registrations and password resets.
What character set is best for a WiFi password?
A 16–20 character mix of upper/lowercase letters and digits with no symbols. WPA2/WPA3 allow 8–63 characters, but smart TVs, printers and IoT devices handle special symbols poorly when you type them. A purely alphanumeric set is most reliable: untick "symbols", set the length to 16–20, and paste it into your router console — far stronger than an 8-digit numeric PIN.
How should server and database passwords be set?
Servers are exposed to the public internet — use 20–32 characters with all four classes, prefer key-based SSH auth with the password as a console fallback. Database and middleware passwords: 24–32 characters, stored in config files read by programs (no need for humans to memorize them). Use the batch mode here to generate several unique sets for root, ops accounts and databases.