Password Generator
A password generator creates a random password that nobody can guess. This one is free, needs no signup, and lets you set the length, symbols, numbers and letter case, or make a passphrase or PIN instead. Everything runs in your browser.
1 Settings
A PIN is digits only, by definition much lower entropy than a password or passphrase of the same length — meant for a device unlock code or similar, not for anything an attacker could try offline at scale.
2 Result
Batch results
Generated entirely in your browser with a cryptographically secure random source — nothing you generate here is ever sent to a server.
Why "random-looking" isn't the same as random
Most homemade passwords — a real word with a capital letter and a "!" tacked on, a birthday, a keyboard pattern — feel unpredictable to the person typing them but fall to a modern cracking tool almost instantly, because those tools are built specifically around the patterns humans default to. A password only resists brute-forcing if it was generated by an actual random process wide enough that no shortcut exists: no dictionary, no pattern list, nothing except trying every possibility. That's what this tool does — every character or word is drawn using the browser's crypto.getRandomValues(), a cryptographically secure random source, with unbiased rejection sampling so every option in the pool has exactly equal odds.
Reading the strength meter
The entropy figure is bits — each additional bit doubles the number of equally likely results, which is the standard way to measure how many guesses a brute-force attack actually needs. The crack-time estimate assumes an offline attacker checking 100 billion guesses per second (roughly one modern GPU against a fast, unsalted hash) — a deliberately pessimistic scenario, so a password that scores well here is comfortably safe against real-world password storage too. For example, at this tool's defaults:
16 chars, all 4 character types → 102.8 bits → ~1.4 trillion years to crack (Excellent)
12 chars, letters + numbers only → 71.5 bits → ~511 years to crack (Strong)
8 chars, lowercase letters only → 37.6 bits → ~1 second to crack (Fair)
4-word passphrase (this list) → 44.0 bits → ~2 minutes to crack (Fair)
6-digit PIN → 19.9 bits → instantly (Very weak)The gap between an 8-character lowercase-only password and a 16-character password using all four character types is the entire point: length and character variety both compound, and a short password is a short password no matter how "random" its letters feel to type. A PIN is intentionally low-entropy by design — appropriate for a device that locks out after a few wrong attempts, never for anything an attacker can try offline at scale. For a deeper walkthrough of what actually makes a password hard to crack, see the password security guide, and pair a strong password with a real password manager rather than memorizing dozens of them — this tool's Base64 Encoder / Decoder is useful if you ever need to inspect how a password manager's export actually encodes its data.
How to generate a strong password
-
1
Pick a type
Choose Password (random characters), Passphrase (random dictionary words) or PIN (digits only) from the tabs.
-
2
Tune the settings
Adjust length and character types for a password, word count and separator for a passphrase, or digit count for a PIN.
-
3
Check the strength meter
Every change instantly updates the entropy (bits) and estimated offline crack time, so you can see the effect of each setting.
-
4
Copy it
Click Copy for a single result, or set a quantity above 1 to generate a batch and Copy all at once.
Common use cases
- Creating a new account, or replacing a password after a data-breach notification.
- Setting a strong Wi-Fi password, then sharing it with a guest card from the QR Code Generator.
- Generating database passwords, API credentials and application secrets during development.
- Choosing a memorable passphrase for the one password you must type from memory, such as a password manager or disk encryption.
- Producing a batch of temporary passwords for new team members, each changed at first login.
Tips and common mistakes
- Never reuse a password. When one site is breached, attackers try the same email and password on many others, a technique called credential stuffing.
- Store it, don't share it in plain text. Save new passwords straight into a password manager rather than pasting them into email, chat or support tickets.
- If a site rejects symbols, add length. Turn off Symbols and increase the length instead; the strength meter shows how much extra length restores the lost entropy. NIST's password guidelines make the same call: they prioritize length and tell services not to impose character-mix rules.
- Want the reasoning behind these settings? Our article on what makes a random password uncrackable compares the common ways people create passwords.
- Pair it with two-factor authentication. A strong password stops guessing, but not phishing; a second factor protects the account even if the password is stolen.
Frequently asked questions
It uses the browser's crypto.getRandomValues() CSPRNG — the same cryptographically secure source browsers use for TLS keys — never Math.random(), which is not cryptographically secure and can be predicted from enough observed output. Character selection also uses rejection sampling instead of a plain modulo, so every character in the pool has exactly equal odds of appearing; a naive % operation is measurably biased toward the first few characters of whatever set you're drawing from.
No. Every password, passphrase and PIN is generated entirely in your browser with JavaScript — nothing you generate here is ever transmitted, logged, or stored anywhere, including by Frost Rank itself. Closing the tab is enough to make it gone for good.
At least 15 characters for anything important, and 16 or more is a sensible default (it's what this tool starts at). NIST's current guidelines set 15 characters as the minimum for a password used on its own, and 8 only when it's paired with a second factor. Length matters more than adding symbols: each extra random character multiplies the number of possible passwords. A passphrase of 4 to 5 random words is a good alternative when you need to type it.
Entropy is log2 of the number of passwords your settings could equally likely produce, so each added bit doubles it; it depends only on the character set and length, not on how complex the result looks. The crack time assumes an offline attacker making 100 billion guesses per second, roughly one modern GPU against a fast, unsalted hash like MD5. That's deliberately pessimistic: a slow, salted hash (bcrypt, Argon2) is many orders of magnitude harder, so a password that scores well here is comfortably safe in practice.
A passphrase (several random dictionary words) is easier to type and read aloud correctly, and can reach the same entropy as a shorter random-character password with fewer keystrokes — this tool's default 4-word passphrase and 16-character password are both comfortably in the "strong" range. Where it matters is sites with a strict character-count cap: a random-character password packs more entropy per character, so it wins when length is limited.
Yes. A long, random password is exactly what a bank account should have, as long as it's unique to that account and kept in a password manager rather than reused or written in a note. If your bank limits length or rejects some symbols, turn those options off and add length to keep the strength up. Also switch on two-factor authentication in your bank's app; a strong password doesn't protect you from phishing on its own.
The "exclude ambiguous characters" option removes lookalikes like I, l, 1, O and 0 that are easy to misread in some fonts or mistype when copying a password by hand off a screen or printout. It's purely a readability convenience — turning it on very slightly shrinks the character pool, which very slightly lowers the entropy for the same length, so leave it off if you're always copying the password digitally rather than retyping it.
Uses the Web Crypto API's cryptographically secure random source with unbiased rejection sampling, not Math.random() — the entropy and crack-time figures shown are computed directly from the actual character pool and length used, not a fixed marketing number.
Was this tool helpful?
Rate it and leave a comment — takes 10 seconds, and genuinely helps decide what to fix or build next.