Password Generator
Strong passwords and memorable passphrases, generated in your browser and never transmitted.
A free password generator that runs entirely on your device using crypto.getRandomValues, the cryptographically secure random source built into your browser — never Math.random, which is predictable. Choose a random string or a passphrase you can actually remember, see its real strength in bits, and copy it. Nothing is sent to any server, nothing is logged, and the page keeps working with the internet disconnected.
An offline attacker guessing a trillion times a second would need longer than the universe has existed on average. That assumes the attacker already has the password file — which is exactly the scenario a strong password is for.
Checking a password against a breach database means sending something derived from it to somebody else's server. Done carefully that can be safe, but this page promises that nothing you generate is transmitted, and a promise with a quiet exception is not a promise. A freshly generated password has never existed before, so it cannot be in a breach list. If you want to check an old password, use Have I Been Pwned directly, and change anything it flags rather than reasoning about it.
Generated in your browser using crypto.getRandomValues, the cryptographically secure random source built into every modern browser — never Math.random, which is predictable and unsuitable for this. Nothing is sent anywhere, nothing is stored, and this page has no analytics on the generated value. You can disconnect from the internet and it still works.
Generating a strong password is easy. Remembering forty of them is not.
A free account includes the vault: every credential encrypted on your device with a master passphrase the server never sees, so even we cannot read them.
Frequently asked questions
Is this password generator safe to use?
Everything happens inside your browser. The page makes no network request when generating, so the password never leaves your device — you can prove it by turning off Wi-Fi and watching it keep working. Randomness comes from crypto.getRandomValues, the browser's cryptographically secure source, rather than Math.random, which is predictable and unsuitable for security.
How long should my password be?
For anything that matters, sixteen characters or more with mixed character types, which lands above 100 bits of entropy and is beyond brute force. Length helps far more than complexity: a long lowercase passphrase beats a short string with symbols in it. The strength meter shows the real figure so you can judge rather than guess.
What is a passphrase and why use one?
A passphrase is several random words joined together, like river-candle-flint-mountain. It reaches similar strength to a random string while remaining possible to remember and to type on a phone, which matters for the handful of passwords you cannot store in a manager — your device login and your password manager's own master passphrase.
Why is there no button to check if a password was breached?
Because checking means sending something derived from the password to another server, and this page promises that nothing is transmitted. A promise with a quiet exception is not a promise. A freshly generated password has never existed before so it cannot be in any breach list; to check an old one, use Have I Been Pwned directly and change anything it flags.
Do I need an account?
No. There is no sign-up, no limit and no ads. An account is only relevant if you want to store credentials, which the encrypted vault does — but the generator itself asks nothing of you.
Does this work offline?
Yes. Once the page has loaded you can disconnect entirely and it keeps generating. That is a useful way to satisfy yourself that nothing is being sent anywhere.