Length beats complexity
Every extra random character multiplies an attacker's work. Clever substitutions are the first thing cracking tools try.
P@ssw0rd2026!instantly
qrxzkwtmvbplnhdyfgsa316 million years
Free password generator
Strong passwords.
Created on your device.
Generate a random password, a passphrase or a PIN, choose its length and copy it in one click. Every password is created in your browser and stays on your device. Free, with no account needed.
- Generated on your device
- No sign-up, ever
- Works offline
Calculating…
PINs are only safe where attempts are limited, like a phone or a bank card. Obvious ones (1234, 0000, 1212) are skipped.
10 fresh passwords
Time to crack your new password
Measuring…
Worst case: an offline attack on a fast hash by a GPU cluster testing one trillion guesses per second.
You are here
- 1 second
- 1 hour
- 1 year
- A lifetime
- The pyramids
- Since the dinosaurs
- Age of the universe
Zero-knowledge by design
Don't trust us.
Verify it.
Your passwords are generated locally. If you accept analytics, usage requests may appear in the network panel, but they never contain your passwords. Inspect the requests below or read our privacy policy.
- Web Crypto randomness. Every character comes from
crypto.getRandomValues(), the generator browsers trust for encryption keys, with unbiased sampling. - Works in airplane mode. After your first visit the site is cached on your device. Turn off Wi-Fi: it keeps working.
- No account, no storage. Passwords live in this tab's memory and disappear when you close it.
page loadHTML, CSS, scripts and fontsdone
page loadword list for passphrases, cacheddone
--:--:--Click the generator to start watching…
Requests since your first click: 0Passwords sent: 0
0
passwords ever sent to a server, stored or logged
1012
guesses per second assumed in our worst-case math
64
characters max, or passphrases of up to 12 words
7
free tools, from Wi-Fi QR codes to policy scripts
The toolkit
Everything you need to lock it down.
More free tools, same promise: your secrets stay on your device.
Passphrase generator
Random words you can actually remember, with the entropy of a 16-character password.
Open toolWi-Fi password + QR code
A strong WPA2/WPA3 key and a QR code your guests scan to join, with a card to print.
Open toolStrength test
See your password the way an attacker does: patterns, entropy and four crack-time scenarios.
Open toolBreach checker
Find out if a password already leaked, without ever revealing it (k-anonymity).
Open toolPassword policy builder
NIST, PCI DSS and CIS presets with ready-to-run Windows, Active Directory and Linux scripts.
Open toolCrack-time table
How long every length and character mix survives a modern GPU cracking rig.
Open toolCrack-time table
8 characters with symbols? Under an hour. 16 characters? Longer than the universe has existed.
We mapped every length and character mix against four real attack speeds. Find your row before an attacker does.
The short version
Strong passwords in 2026, in three rules.
Forget the old advice about swapping letters for symbols. This is what actually stops attackers.
One password, one account
When one site leaks, bots try the same email and password on thousands of others within hours. That is credential stuffing.
shop-site.comleaked
your-email.comunlocked
your-bank.comunlocked
Let a manager remember
A password manager stores hundreds of unique passwords behind one strong passphrase. Add passkeys and MFA wherever you can.
you remember1 passphrase
manager storesevery password
passkeysnothing to phish
Questions
Frequently asked questions
What makes a password strong in 2026?
Length and randomness. A strong password has at least 16 random characters (or 6 or more random words) and is used for one account only. Composition rules such as one capital and one symbol help far less than people think: P@ssw0rd! follows them and is still cracked instantly.
Is it safe to use an online password generator?
This generator creates passwords on your device with your browser's Web Crypto API (crypto.getRandomValues). Your passwords are never sent to us. If you accept analytics, usage events are sent without passwords. You can inspect network requests in your browser's developer tools and read our privacy policy.
How long should my password be?
Aim for 16 characters or more for everyday accounts, and 20 or more for your email, your bank and your password manager. If you need to type or remember it, use a passphrase of 6 or 7 random words instead.
Random password or passphrase: which is better?
Both are excellent when they are truly random. Random passwords pack the most strength per character and are ideal inside a password manager. Passphrases are easier to type and remember, which makes them perfect for a master password or a computer login. Try the passphrase generator.
How do you estimate the time to crack?
We measure the entropy of the password (how many guesses an attacker needs, on average) and divide it by an attack speed. The headline figure assumes the worst realistic case: an offline attack on a fast hash by a GPU cluster making one trillion guesses per second. The strength test also shows slower, more common scenarios.
Should I change my passwords every 90 days?
No. Current NIST guidance says forced periodic changes make passwords weaker, because people make small, predictable edits. Change a password when it may have been exposed, and use a unique one everywhere. Read our NIST guide.
Are passkeys replacing passwords?
Gradually. Passkeys resist phishing and you should turn them on wherever they are offered. Most people will still need strong, unique passwords for years on sites that do not support them yet. Passkeys vs. passwords, explained.
From the blog
Learn the attacker's playbook
Practical guides
A Small-Business Password Policy: Template and Rollout Checklist
Turn password settings into a policy your team can use. Start with an editable example, assign owners and test the technical controls before rollout.
Practical guidesHow to Make a Wi-Fi QR Code and Print a Guest Card
Give visitors a Wi-Fi card they can scan. Use your current network details, choose a printable format and check the connection before sharing it.
Policy and complianceNIST Password Guidelines: What SP 800-63B Really Requires
Longer minimums, no more forced 90-day changes and no more 'one capital, one symbol'. Here is what the current NIST rules actually say, and how to apply them this week.
Your next password is one click away.
Free forever, no account, nothing to install. Bookmark it, or install it as an app from your browser menu.