Length beats complexity
Every extra random character multiplies an attacker's work. Clever substitutions are the first thing cracking tools try.
P@ssw0rd2026!instantly
qrxzkwtmvbplnhdyfgsa316 million years
Strong password generator Passwords that outlive the universe.
Random passwords, memorable passphrases and PINs in one tap. They are created by your browser's cryptographic engine and never leave your device. Not even we can see them.
- Generated on your device
- No sign-up, ever
- Works offline
Calculating…
PINs are only safe where attempts are limited, like a phone or a bank card. Obvious ones (1234, 0000, 1212) are skipped.
10 fresh passwords
Time to crack your new password
Measuring…
Worst case: an offline attack on a fast hash by a GPU cluster testing one trillion guesses per second.
You are here
- 1 second
- 1 hour
- 1 year
- A lifetime
- The pyramids
- Since the dinosaurs
- Age of the universe
Zero-knowledge by design
Don't trust us.
Verify it.
Open your browser's developer tools, pick the Network tab and generate a few passwords. Not a single request goes out. The panel here runs the same check, live, from your first click.
- Web Crypto randomness. Every character comes from
crypto.getRandomValues(), the generator browsers trust for encryption keys, with unbiased sampling. - Works in airplane mode. After your first visit the site is cached on your device. Turn off Wi-Fi: it keeps working.
- No account, no storage. Passwords live in this tab's memory and disappear when you close it.
page loadHTML, CSS, scripts and fontsdone
page loadword list for passphrases, cacheddone
--:--:--Click the generator to start watching…
Requests since your first click: 0Passwords sent: 0
0
passwords ever sent to a server, stored or logged
1012
guesses per second assumed in our worst-case math
64
characters max, or passphrases of up to 12 words
6
free tools, from breach checks to policy scripts
The toolkit
Everything you need to lock it down.
More free tools, same promise: your secrets stay on your device.
Passphrase generator
Random words you can actually remember, with the entropy of a 16-character password.
Open toolStrength test
See your password the way an attacker does: patterns, entropy and four crack-time scenarios.
Open toolBreach checker
Find out if a password already leaked, without ever revealing it (k-anonymity).
Open toolPassword policy builder
NIST, PCI DSS and CIS presets with ready-to-run Windows, Active Directory and Linux scripts.
Open toolCrack-time table
How long every length and character mix survives a modern GPU cracking rig.
Open toolCrack-time table
8 characters with symbols? Under an hour. 16 characters? Longer than the universe has existed.
We mapped every length and character mix against four real attack speeds. Find your row before an attacker does.
The short version
Strong passwords in 2026, in three rules.
Forget the old advice about swapping letters for symbols. This is what actually stops attackers.
One password, one account
When one site leaks, bots try the same email and password on thousands of others within hours. That is credential stuffing.
shop-site.comleaked
your-email.comunlocked
your-bank.comunlocked
Let a manager remember
A password manager stores hundreds of unique passwords behind one strong passphrase. Add passkeys and MFA wherever you can.
you remember1 passphrase
manager storesevery password
passkeysnothing to phish
Questions
Frequently asked questions
What makes a password strong in 2026?
Length and randomness. A strong password has at least 16 random characters (or 6 or more random words) and is used for one account only. Composition rules such as one capital and one symbol help far less than people think: P@ssw0rd! follows them and is still cracked instantly.
Is it safe to use an online password generator?
It is when the password is created on your device, as it is here. This generator uses your browser's Web Crypto API (crypto.getRandomValues) and never sends anything over the network. You can confirm it in your browser's developer tools, or by turning off Wi-Fi: the generator keeps working.
How long should my password be?
Aim for 16 characters or more for everyday accounts, and 20 or more for your email, your bank and your password manager. If you need to type or remember it, use a passphrase of 6 or 7 random words instead.
Random password or passphrase: which is better?
Both are excellent when they are truly random. Random passwords pack the most strength per character and are ideal inside a password manager. Passphrases are easier to type and remember, which makes them perfect for a master password or a computer login. Try the passphrase generator.
How do you estimate the time to crack?
We measure the entropy of the password (how many guesses an attacker needs, on average) and divide it by an attack speed. The headline figure assumes the worst realistic case: an offline attack on a fast hash by a GPU cluster making one trillion guesses per second. The strength test also shows slower, more common scenarios.
Should I change my passwords every 90 days?
No. Current NIST guidance says forced periodic changes make passwords weaker, because people make small, predictable edits. Change a password when it may have been exposed, and use a unique one everywhere. Read our NIST guide.
Are passkeys replacing passwords?
Gradually. Passkeys resist phishing and you should turn them on wherever they are offered. Most people will still need strong, unique passwords for years on sites that do not support them yet. Passkeys vs. passwords, explained.
From the blog
Learn the attacker's playbook
Policy and compliance
NIST Password Guidelines: What SP 800-63B Really Requires
Longer minimums, no more forced 90-day changes and no more 'one capital, one symbol'. Here is what the current NIST rules actually say, and how to apply them this week.
Password managersWhy Your Password Manager Might Be Your Weakest Link (and How to Secure It)
Your password manager is only as strong as its setup. Spot the weak points, from autofill abuse to 2FA stored in the same vault, and lock them down step by step.
PasskeysPasskeys vs. Passwords: Are We Entering a Passwordless Future?
Passkeys replace memorized secrets with cryptographic keys protected by your device. Are they ready to replace passwords? A pragmatic guide, with a plan to switch safely.
Your next password is one click away.
Free forever, no account, nothing to install. Bookmark it, or install it as an app from your browser menu.