Password Generator: Strong Passwords, Passphrases & Usernames

What Is a Password Generator?

A password generator is a tool that creates long, random passwords using a cryptographically secure random number generator (CSPRNG), so the result has no pattern an attacker can predict. This one runs entirely in your browser — nothing you generate is sent to a server, logged, or stored.

The reason random beats "clever" is math. Security is measured in bits of entropy: every extra character multiplies the number of possible combinations. A 16-character password drawn from the full 94-character keyboard set has roughly 10³¹ possible values — about 105 bits of entropy. Even an attacker guessing billions of times per second against a stolen database would need longer than the age of the universe to work through that space.

Human-chosen passwords fail because they cluster around predictable patterns — a capital at the start, a year at the end, a "!" for the required symbol. Attackers know these patterns and test them first. A generator removes the human bias entirely, which is why every serious security guideline recommends generated passwords paired with a password manager.

Why Use This Generator Instead of One Built Into a Password Manager?

Password managers like 1Password, Bitwarden, and LastPass all include built-in generators. So why use a standalone one?

Privacy and trust. A standalone tool that runs entirely in your browser and doesn't have your account credentials is a different trust model than a generator inside a service that stores all your passwords. If you don't want to log into a password manager just to create a throwaway account password, a browser-based generator avoids that.

Length and character control. Most manager generators cap at 20–30 characters and don't expose the fine-grained controls you'll find here: minimum symbol counts, ambiguous character exclusion, embedding a specific word, or generating passphrases from a curated word list. When a sign-up form has unusual requirements, this tool adapts.

No install required. On a shared or temporary device where you don't want to install a password manager, this tool works from any browser in seconds. Generate, copy, use — nothing persists.

Where password managers are still the right choice: for actually storing the passwords you generate. A generator creates a strong password; a manager remembers it. They're complementary, not alternatives. Pair this tool with a manager for the ideal setup.

Three Ways to Generate a Credential

This tool covers the three credentials most sign-up forms actually ask for, switchable from the tabs above the generator:

What Modern Security Guidance Actually Says (2026)

A lot of "password advice" online is out of date. Current guidance from the U.S. National Institute of Standards and Technology (NIST SP 800-63B) — the standard most security teams follow — has changed the rules in ways worth knowing:

Length matters more than complexity. A long password is stronger than a short one stuffed with symbols. NIST recommends supporting passwords up to at least 64 characters and treats length as the primary strength factor.

Forced periodic changes are discouraged. The old "change your password every 90 days" rule is no longer recommended, because it pushes people toward weak, incremental passwords (Summer2024 → Summer2025). You should change a password when there is a reason to — a breach, a shared device, a phishing scare — not on a calendar.

Uniqueness is non-negotiable. The biggest real-world risk today is credential stuffing: attackers take passwords leaked from one breached site and try them everywhere else. A unique generated password per account makes that attack impossible, even if one site is compromised.

Passphrase vs. Random Password: Which Should You Use?

Short answer: use a random password when a password manager will remember it for you, and a passphrase when you genuinely have to type or recall it yourself. Both can reach comparable security — the difference is memorability, not strength.

NIST SP 800-63B explicitly endorses passphrases as a valid, user-friendly way to hit a long minimum length without forcing people into unmemorable symbol soup. A random password packs the most entropy into the fewest characters, which is ideal when you'll never actually type it. A passphrase trades a few extra characters for something a human brain can hold onto — useful for a device PIN screen, a shared home Wi-Fi password, or your password manager's own master password, which is the one password you truly cannot store anywhere else.

How Secure Is This Passphrase Generator?

Each word in a generated passphrase is drawn independently from a curated list of 645 everyday English words — common nouns, adjectives, and verbs, filtered to exclude anything ambiguous, offensive, or awkward to spell. That gives each word position roughly log₂(645) ≈ 9.3 bits of entropy.

A default 5-word passphrase (with the optional trailing number enabled) therefore carries roughly 50 bits of entropy — comparable to an 8-character fully-random password, but built from words a person can actually remember and type without looking. Add a sixth or seventh word using the slider above if you want to push a passphrase toward "very strong" territory for a more critical account.

This is the same principle behind well-known passphrase examples like "correct horse battery staple": length in words, not visual complexity, is what drives real security — as long as the words themselves are chosen by a random process, not by you.

How This Generator Works

When you click generate, the tool builds a character pool from the options you enable — 26 lowercase letters, 26 uppercase, 10 digits, and a set of symbols — then uses your browser's built-in crypto.getRandomValues() CSPRNG to pick each character. That function is the same class of randomness used for encryption keys, not the ordinary Math.random() that can be predicted.

Every position is chosen with uniform probability, so no character or pattern is favored. If you set a custom requirement — say, "at least 3 numbers" — the generator checks the result afterward and swaps in extra digits only if the random draw happened to fall short, so your requirement is always met without weakening the rest of the password. The strength meter then estimates entropy from your length and character choices and maps it to both a categorical rating and the time-to-crack estimate explained below.

Because all of this happens locally in JavaScript, your password never leaves the page. Closing the tab is enough to erase it — there is nothing on our side to leak. The same applies to the session history panel above: it lives only in your browser's memory for this visit and disappears the moment you refresh or navigate away.

Understanding Your Password's Time-to-Crack Estimate

What it means: the "estimated time to crack" figure shown with every generated password is how long an offline attacker would take, on average, to guess it through brute force — assuming they already have a stolen copy of the password's hash and are testing candidates as fast as modern hardware allows.

Our methodology, stated plainly: we assume 10 billion guesses per second, a commonly cited benchmark for a modern GPU rig attacking a fast, unsalted hash, and we estimate the average case as half of the full keyspace (an attacker expects to find a match partway through an exhaustive search, not right at the end). This is a deliberately conservative, worst-case-for-you estimate — a properly salted, slow hash like bcrypt or Argon2 would take dramatically longer to crack than the number shown here. We'd rather under-promise on security than overstate it.

The practical takeaway holds regardless of the exact assumptions: each additional character multiplies the keyspace rather than just adding to it, which is why going from 8 to 16 characters doesn't double your security — it raises it by many orders of magnitude.

Custom Password Requirements: Minimum Numbers & Symbols

What this is for: some sign-up forms enforce their own rules — "must contain at least 2 numbers," "at least 1 special character." The Minimum Numbers and Minimum Symbols sliders let you guarantee those counts up front, so you're never stuck regenerating a password over and over hoping it happens to qualify.

The generator always keeps your requested minimums without shrinking the rest of the password's randomness — if a request would be mathematically impossible for the length you've chosen (for example, asking for more numbers and symbols combined than there are characters), it automatically gives numbers priority and fits as many symbols as the remaining space allows, rather than silently failing.

Should You Put Your Name in a Password?

Short answer: generally, no. Personal information — names, birthdates, pet names — is the very first thing an attacker's cracking dictionary tries, which is why our own password security guide lists it as a top mistake to avoid.

That said, there are legitimate, low-risk situations where embedding a recognizable word helps — labeling a shared team login with a project codename, or creating something you can recognize at a glance across a spreadsheet of test accounts. The "Embed a Word or Name" field above does exactly this: it drops your word into an otherwise fully random password at a random position. We show a visible warning whenever it's used, and the strength meter is deliberately marked down to reflect the real entropy loss — we'd rather be honest about the trade-off than let the feature look safer than it is. Never use it for email, banking, or your password manager's master password.

Free Username Generator

What it does: the Username tab creates either a random word-plus-number handle (for forums, gaming, or any account where you don't want to reuse the same username everywhere), or a "plus-addressed" version of your own email — appending a random tag before the @ symbol, like you+8kd3f1@example.com. Most major email providers (Gmail, Outlook, and others) deliver plus-addressed mail straight to your normal inbox while letting you filter or block by tag.

The practical use case for plus-addressing: give every service a slightly different address, and if you ever start receiving spam on one specific tag, you know exactly which company leaked or sold it — without needing a new inbox.

When Should You Change a Password?

Modern security guidance (NIST SP 800-63B) specifically discourages forced periodic changes — the "change every 90 days" rule creates more problems than it solves because it pushes users toward incremental variations that are easy to guess. Change a password when one of these specific events occurs:

Outside of these events, there's no security benefit to changing a strong, unique password. Save the effort for the accounts and moments that actually matter.

How to Use This Password Generator

How Long Should Your Password Be?

Frequently Asked Questions

Related Tools