Passwords are generated and checked only in your browser, with its built-in cryptographic random source. Nothing is sent to a server, logged or stored — it even works offline.
Generate a password
Check a password’s strength
Start typing…
Generate strong random passwords with your browser’s cryptographic random source, and check the strength of passwords you use. Nothing is ever sent anywhere.
100% free · No sign-up · No daily limits · No watermarks · Processed in your browser — files never leave your device
Generate strong random passwords with your browser’s cryptographic random source, and check the strength of passwords you use. Nothing is ever sent anywhere.
A 16-character password using all four character sets is drawn from a pool of about 88 symbols and carries roughly 103 bits of entropy — beyond any realistic brute-force attack. Compare a memorable word-plus-year password: the checker rates that in minutes-to-hours territory and flags both the dictionary word and the predictable digits.
Generation uses crypto.getRandomValues — the operating system’s cryptographic random source, the same class of randomness browsers rely on for security keys — with rejection sampling, so every character in the pool is equally likely and there is no modulo bias. The checker estimates entropy from the character pool and length, then deducts for the patterns attackers try first: dictionary words, names, years, sequences, repeats and keyboard walks. Crack times assume fast offline guessing at ten billion tries per second and are labelled as estimates.
On this one, yes: generation happens in your browser with its built-in cryptographic random function. No password is transmitted, logged or stored, and the page works fully offline once loaded. Do not take our word for it — generate one with your network disconnected.
Length beats cleverness. 16 characters is a strong default for important accounts; 20 or more for your email and for the password manager itself. Every extra character multiplies the attacker’s search space by the size of the character pool.
A rough measure of unpredictability: each bit doubles the number of guesses an attacker needs on average. Around 40 bits falls to a determined offline attack; 80 or more bits is out of practical reach; a generated 16-character password here clears 100 bits.
Length alone is not strength if the content is predictable: a long password built from a dictionary word, a repeat and a year is exactly what cracking tools try first. Length plus randomness is the combination that works.
Where a site allows them, yes — they widen the pool and add entropy to every character. If a site bans symbols, compensate with length: a 20-character password of letters and digits is still extremely strong.