Online Password Generator

Passwords, passphrases, PINs and keys

The tabs above the output switch between four kinds of secret. All four draw on the same local source of randomness — only the alphabet and the rules change.

Random password — length 4 to 128 with any mix of uppercase, lowercase, digits and symbols. Under Advanced options sit the settings real sites force on you: exclude look-alike characters (0/O, 1/l/I) for anything you will retype by hand, ban specific characters a site rejects, require a minimum count per character type, forbid repeats or keyboard runs like abc and qwe, or dictate the exact shape with a template (A uppercase, a lowercase, # digit, ! symbol, C consonant, v vowel).

Passphrase — several random words instead of one scrambled string, the correct-horse-battery-staple idea from XKCD 936. Words come from the EFF large wordlist, 7,776 entries and the diceware standard, so each word adds 12.9 bits: five words is roughly 65 bits and, unlike xK9#mP2$vL5@nQ8, you can hold it in your head long enough to type it on a phone. Set the separator, capitalize the words, or append digits and a symbol when a site insists. The second style skips English words entirely and builds pronounceable syllables (tokrilmufsad) — easier to dictate over the phone and it assumes nothing about your keyboard layout.

PIN — 3 to 12 digits for phone locks, SIM cards, alarm panels and bank cards. The predictable ones never come out: 1234, 0000, all-identical digits and anything that reads as a birth year are rejected and re-rolled. That filter matters more than it sounds — in analyses of leaked PIN datasets, the twenty most common four-digit combinations account for around a quarter of all of them.

Keys — random secrets in the formats code expects: hexadecimal, Base64, or plain letters and digits. You size them in bytes, so 32 bytes gives a 256-bit key (64 hex characters, 44 in Base64) for an API key, a session secret, JWT_SECRET or SECRET_KEY. The same tab produces 2FA backup codes in the format you know from GitHub (k7fp-2mqx), built from an alphabet with no look-alike characters so they survive being written down on paper.

Why this tool runs only in your browser

Most password generators work fine — until you stop to think about what’s actually happening. When you generate a password on a server, that server theoretically sees it. For most sites this is probably fine. But “probably” isn’t the certainty you want when setting up your bank account or email.

This generator was built around one principle: the password never leaves your device. Everything runs in JavaScript directly in your browser. The relevant part of the code:

const array = new Uint8Array(length);
crypto.getRandomValues(array);

crypto.getRandomValues() draws entropy from your operating system’s random number generator — the same source used by cryptographic libraries. Close this tab and the password is gone. No logs, no database, no server.

The problem with password “tricks”

For years, security advice sounded like this: take a word, capitalize the first letter, add a number at the end, swap one letter for a symbol. P@ssw0rd type of thing.

Attackers know these tricks. Dictionary attacks don’t just try common words — they try common words with common modifications. P@ssw0rd isn’t a strong password; it’s a weak password in costume.

“Passwords are like underwear: don’t let people see them, change them often, and you shouldn’t share them with strangers.”
— Chris Pirillo

The real shift came with password managers. When you don’t have to remember a password — when it lives securely in Bitwarden, 1Password, or KeePass — there’s no reason not to use something like xK9#mP2$vL5@nQ8 for every account. Generate, copy, store. That’s the entire workflow.

The need to change passwords regularly was one of the original reasons this tool was built. Rotating a password should take 30 seconds, not a headache.

How long is long enough?

Length matters more than complexity. A 20-character lowercase password has more entropy than a 10-character password with all four character types. Both matter, but length wins.

Password	Length	Time to crack
password123	11 chars	< 1 second
JanNovak1985	12 chars	3 hours
Abc123!@#	9 chars	2 days
MyD0g!sF1uffy	13 chars	5 years
Tr$7mK@p9Lq2	12 chars	200+ years
xK9#mP2$vL5@nQ8	15 chars	34,000 years

NIST Special Publication 800-63B recommends a minimum of 8 characters but notes that length is the primary driver of strength — mandatory special character requirements often backfire by making passwords more predictable.

What character types do

• Uppercase (A–Z) — 26 possibilities per position
• Lowercase (a–z) — another 26
• Numbers (0–9) — 10
• Symbols (!@#$%…) — 32+ depending on the character set

At 16 characters with all four types (94 possible values per position): 94¹⁶ ≈ 3.7 × 10³¹ combinations. A modern GPU cluster cracking one billion passwords per second would need longer than the age of the universe.

For developers: keys, secrets and bulk output

The Keys tab exists because changeme and secret123 end up in .env files more often than anyone admits. Generate the value in the format the library actually expects — hex for anything that wants a raw key, Base64 for tokens and headers, alphanumeric where a shell or a URL would choke on + and / — and size it in bytes rather than characters, since that is how key strength is specified: 16 bytes is a 128-bit key, 32 bytes is 256-bit.

Everything comes from crypto.getRandomValues(), the browser’s CSPRNG — the same class of source as secrets in Python or crypto/rand in Go, and emphatically not Math.random(), which is predictable enough to reconstruct.

Below the panels, Generate several at once produces up to 1,000 values and downloads them as TXT, CSV, JSON, YAML, .env or SQL — for seeding test accounts, handing out initial credentials, or filling a column without writing a throwaway script. Bulk output follows the random-password settings (or your template), not the passphrase and PIN tabs.

Two smaller conveniences: Clear the clipboard 60 seconds after copying limits how long a secret sits in the system clipboard, and Saved settings keeps a named set of rules in your browser, so a policy you reach for often — 20 characters, no symbols, no look-alikes — is one click away. The page URL carries those settings too, never the generated value, so a policy is safe to bookmark or send to a colleague.

The case for a password manager

Generating strong passwords is pointless if you reuse them or store them in a passwords.txt on your desktop. Verizon’s Data Breach Investigations Report consistently finds that 81% of breaches involve stolen or weak passwords. The most common reason people reuse passwords: too many accounts to track.

Password managers solve this cleanly:

• Bitwarden — open source, free tier covers most needs, works on all platforms
• 1Password — polished UI, excellent family/team sharing
• KeePass — fully local, no cloud, complete control

When a password leaks

1. Change it immediately on every account where you used it
2. Enable 2FA on the affected account
3. Check Have I Been Pwned — enter your email to see past breaches
4. Review active sessions and revoke anything unfamiliar

Recommendations by account type

Financial accounts

• 16+ characters, all character types
• Unique password, never reused
• 2FA via authenticator app (not SMS)

Email

• 14+ characters — your email resets every other password, making it the crown jewel of your security
• Mandatory 2FA
• Regularly check logged-in devices

Social media

• 12+ characters
• 2FA via authenticator app — SMS-based 2FA is vulnerable to SIM-swapping attacks

Work accounts

• Follow company policy (typically 14+)
• Never use personal passwords on work systems; change immediately when leaving

Common mistakes worth avoiding

Storing passwords in plain text (passwords.txt, notes app, email drafts) — use an encrypted password manager instead.

Sharing passwords via chat or email — use Bitwarden Send or similar secure sharing if you must share at all.

Trusting browsers as your only password manager — browsers improve, but a dedicated manager with a master password offers better encryption and cross-platform support.

FAQ

Is this generator really private?

Yes. Open your browser's developer console (F12) while generating a password and check the Network tab — you'll see zero requests sent. Everything runs locally.

How often should I change passwords?

When there's a reason: a known breach, suspicion of compromise, or after sharing access. NIST no longer recommends mandatory periodic rotation for its own sake — forced frequent changes typically result in weaker, predictable passwords.

Can I use the same password for multiple accounts?

No. One breach exposes every account sharing that password. A password manager makes maintaining unique passwords for hundreds of accounts effortless.

Password or passphrase — which should I use?

Use a random password for everything a password manager types for you, and a passphrase for the few secrets you have to type yourself: the manager's master password, disk encryption, your laptop login. Five words from the EFF list is about 65 bits of entropy — comparable to a 10-character random password using all four character types — and far easier to enter correctly on a phone or a TV remote.

Can I generate a random PIN?

Yes, the PIN tab produces 3 to 12 digits and refuses the predictable ones: 1234, 0000, repeated digits and birth years. Six digits instead of the usual four costs you almost nothing to type and multiplies the number of guesses an attacker needs by a hundred.

Can I use this for API keys and application secrets?

That is what the Keys tab is for: hexadecimal, Base64 or alphanumeric output, sized in bytes. 32 bytes is a 256-bit key, which is what most libraries mean by a strong secret for JWT_SECRET, SECRET_KEY or a webhook signature. The same tab also generates 2FA backup codes.

Can I generate more than one at a time?

Generate several at once produces up to 1,000 values and downloads them as TXT, CSV, JSON, YAML, .env or SQL. It uses the random-password settings or your template, so it is meant for seeding accounts and test data rather than for the passphrase and PIN tabs.

What's stronger — length or complexity?

Length. A 20-character lowercase-only password has more entropy than a 10-character password using all character types. Use both, but prioritize length.

What if I forget a password?

Use a password manager so you only need to remember one master password. For accounts without a manager, most services offer email-based recovery — which is why protecting your email with a strong password and 2FA is non-negotiable.

Password strength statistics

• 81% of business breaches involve stolen or weak passwords (Verizon DBIR)
• 59% of people reuse passwords across multiple accounts
• 23% of the most common passwords can be cracked in under 1 second
• The average user has 100+ online accounts requiring passwords