I would appreciate if you could share these pages with friends, bookmark them, or link to them. Thank you! 🙏

Online Password Generator

Acrafto Team Security
Updated
Keyboard shortcuts: Space — generate · C — copy
Advanced options
Minimum per character type
Show the math

Time to crack
Time to crack
Speed depends on how the target site hashes passwords, not just on the attacker hardware.
This session
    Kept in memory only. Closing the tab erases it.

    Generate several at once

    Saved settings

    Everything runs in your browser. No password is ever sent, stored or logged.

    Why this tool runs only in your browser

    Most password generators work fine — until you stop to think about what’s actually happening. When you generate a password on a server, that server theoretically sees it. For most sites this is probably fine. But “probably” isn’t the certainty you want when setting up your bank account or email.

    This generator was built around one principle: the password never leaves your device. Everything runs in JavaScript directly in your browser. The relevant part of the code:

    const array = new Uint8Array(length);
    crypto.getRandomValues(array);

    crypto.getRandomValues() draws entropy from your operating system’s random number generator — the same source used by cryptographic libraries. Close this tab and the password is gone. No logs, no database, no server.

    The problem with password “tricks”

    For years, security advice sounded like this: take a word, capitalize the first letter, add a number at the end, swap one letter for a symbol. P@ssw0rd type of thing.

    Attackers know these tricks. Dictionary attacks don’t just try common words — they try common words with common modifications. P@ssw0rd isn’t a strong password; it’s a weak password in costume.

    “Passwords are like underwear: don’t let people see them, change them often, and you shouldn’t share them with strangers.”
    — Chris Pirillo

    The real shift came with password managers. When you don’t have to remember a password — when it lives securely in Bitwarden, 1Password, or KeePass — there’s no reason not to use something like xK9#mP2$vL5@nQ8 for every account. Generate, copy, store. That’s the entire workflow.

    The need to change passwords regularly was one of the original reasons this tool was built. Rotating a password should take 30 seconds, not a headache.

    How long is long enough?

    Length matters more than complexity. A 20-character lowercase password has more entropy than a 10-character password with all four character types. Both matter, but length wins.

    PasswordLengthTime to crack
    password12311 chars< 1 second
    JanNovak198512 chars3 hours
    Abc123!@#9 chars2 days
    MyD0g!sF1uffy13 chars5 years
    Tr$7mK@p9Lq212 chars200+ years
    xK9#mP2$vL5@nQ815 chars34,000 years

    NIST Special Publication 800-63B recommends a minimum of 8 characters but notes that length is the primary driver of strength — mandatory special character requirements often backfire by making passwords more predictable.

    What character types do

    • Uppercase (A–Z) — 26 possibilities per position
    • Lowercase (a–z) — another 26
    • Numbers (0–9) — 10
    • Symbols (!@#$%…) — 32+ depending on the character set

    At 16 characters with all four types (94 possible values per position): 94¹⁶ ≈ 3.7 × 10³¹ combinations. A modern GPU cluster cracking one billion passwords per second would need longer than the age of the universe.

    The case for a password manager

    Generating strong passwords is pointless if you reuse them or store them in a passwords.txt on your desktop. Verizon’s Data Breach Investigations Report consistently finds that 81% of breaches involve stolen or weak passwords. The most common reason people reuse passwords: too many accounts to track.

    Password managers solve this cleanly:

    • Bitwarden — open source, free tier covers most needs, works on all platforms
    • 1Password — polished UI, excellent family/team sharing
    • KeePass — fully local, no cloud, complete control

    When a password leaks

    1. Change it immediately on every account where you used it
    2. Enable 2FA on the affected account
    3. Check Have I Been Pwned — enter your email to see past breaches
    4. Review active sessions and revoke anything unfamiliar

    Recommendations by account type

    Financial accounts

    • 16+ characters, all character types
    • Unique password, never reused
    • 2FA via authenticator app (not SMS)

    Email

    • 14+ characters — your email resets every other password, making it the crown jewel of your security
    • Mandatory 2FA
    • Regularly check logged-in devices

    Social media

    • 12+ characters
    • 2FA via authenticator app — SMS-based 2FA is vulnerable to SIM-swapping attacks

    Work accounts

    • Follow company policy (typically 14+)
    • Never use personal passwords on work systems; change immediately when leaving

    Common mistakes worth avoiding

    Storing passwords in plain text (passwords.txt, notes app, email drafts) — use an encrypted password manager instead.

    Sharing passwords via chat or email — use Bitwarden Send or similar secure sharing if you must share at all.

    Trusting browsers as your only password manager — browsers improve, but a dedicated manager with a master password offers better encryption and cross-platform support.

    FAQ

    Is this generator really private? Yes. Open your browser's developer console (F12) while generating a password and check the Network tab — you'll see zero requests sent. Everything runs locally.
    How often should I change passwords? When there's a reason: a known breach, suspicion of compromise, or after sharing access. NIST no longer recommends mandatory periodic rotation for its own sake — forced frequent changes typically result in weaker, predictable passwords.
    Can I use the same password for multiple accounts? No. One breach exposes every account sharing that password. A password manager makes maintaining unique passwords for hundreds of accounts effortless.
    What's stronger — length or complexity? Length. A 20-character lowercase-only password has more entropy than a 10-character password using all character types. Use both, but prioritize length.
    What if I forget a password? Use a password manager so you only need to remember one master password. For accounts without a manager, most services offer email-based recovery — which is why protecting your email with a strong password and 2FA is non-negotiable.

    Password strength statistics

    • 81% of business breaches involve stolen or weak passwords (Verizon DBIR)
    • 59% of people reuse passwords across multiple accounts
    • 23% of the most common passwords can be cracked in under 1 second
    • The average user has 100+ online accounts requiring passwords