Password Generator

Generate strong, secure passwords with KeePass-style options. Custom length, character sets, pronounceable mode, and real-time entropy strength meter. 100% client-side — nothing leaves your browser.

Options
Password Length
Generation Mode
U=upper  l=lower  d=digit  !=special  -=minus  _=underline  b=bracket  s=space  *=any
Character Sets
Exclusions
Generated Passwords
Strength
Entropy
Charset size
Est. crack time
Length
Ready
Press Ctrl+Enter to regenerate

How to generate a strong password

A few options make the difference between a guessable password and one that won't be cracked in your lifetime.

01

Choose your length

Set length to 20+ characters. Each extra character multiplies complexity exponentially. A 20-char password is astronomically harder to crack than a 10-char one.

02

Select character sets

Enable uppercase, lowercase, digits, and special characters together. A password using all four character types with 16+ chars is practically uncrackable by brute force.

03

Check the strength meter

Watch the entropy-based strength bar. Aim for "Very Strong" (80+ bits of entropy). The crack time estimate shows how long brute-force would take at 1 trillion guesses/second.

04

Copy and store safely

Click Copy to grab the password. Store it in a password manager like Bitwarden, 1Password, or KeePass — never in a text file or sticky note.

Password security best practices

Generating a strong password is step one. Here's what else matters.

🔑

Use a unique password per site

Never reuse passwords. If one site is breached, attackers try the same password everywhere (credential stuffing). Generate a new password for every account.

🔒

Use a password manager

A good password manager (Bitwarden, 1Password, KeePass) remembers all your unique passwords. You only need to remember one master password.

📱

Enable two-factor authentication

Even the strongest password can be phished or leaked. 2FA means attackers need your password AND your phone. Always enable it on critical accounts.

🔐

Length beats complexity

A 20-character lowercase password has more entropy than a 12-character mixed password. Length is the single most important factor in password security.

🚫

Avoid predictable patterns

Password1!, P@ssword, or your birthday are weak despite containing special chars. Random generation removes all human predictability from your passwords.

Check for data breaches

Use HaveIBeenPwned to see if your email has been in breaches. If it has, change those passwords immediately — even if they were strong.

Frequently asked questions

Is this password generator actually secure?

Yes. Passwords are generated using crypto.getRandomValues() — the same cryptographically secure random number generator used in banking and security applications. It's not Math.random() (which is predictable). Everything runs in your browser; we never see your passwords.

What is entropy and why does it matter?

Entropy is a measure of unpredictability in bits. It's calculated as log₂(charset_size ^ length). A password with 60 bits of entropy would take a modern GPU cracking rig roughly 36 days to brute-force. At 80 bits, that becomes over 100 years. At 100 bits, longer than the age of the universe. The strength meter shows this calculation in real time.

What's the "Exclude similar characters" option?

It removes characters that look alike in certain fonts: lowercase L (l), number 1 (1), uppercase I (I), number 0 (0), uppercase O (O), and pipe (|). Useful for passwords you need to type manually and want to avoid transcription errors.

What is pronounceable password mode?

Pronounceable mode generates passwords that alternate consonants and vowels, creating syllable-like sequences (e.g., "kovabexi"). They're easier to remember and type while still being randomized. Slightly lower entropy than pure random, but great for passwords you need to memorize.

How does pattern-based generation work?

Enter a pattern like Uulllldd!! where each character represents a class: U=uppercase, l=lowercase, d=digit, !=special, -=minus, _=underline, b=bracket, s=space, *=any random character. This lets you meet specific password requirements (e.g., "must start with a capital and end with a number").

How long should passwords be for different accounts?

For critical accounts (banking, email, password manager master): 20+ characters. For social media and general accounts: 16+ characters. For low-stakes accounts: 12+ characters. When in doubt, longer is always better — password managers remember the length for you.

More free tools

Developer Tool

JSON Formatter

Format, validate, and beautify JSON instantly. Syntax highlighting, error detection, minification.

Writing Tool

Plagiarism Checker

Check text for plagiarism with n-gram fingerprinting. Color-coded results, detailed breakdown.

Developer Tool

Code Formatter

Format XML, SQL, CSS, HTML, and JavaScript instantly. Syntax highlighting, minification, line numbers.

Utility Tool

QR Code Generator

Generate QR codes for URLs, WiFi, contacts, and email. Custom colors and sizes. PNG & SVG download.

Utility Tool

Reverse Image Search

Search by image across Google Lens, TinEye, Yandex, and Bing. Upload, paste, or enter a URL.

Finance Tool

Mortgage Calculator

Calculate monthly payments with amortization schedule, payment breakdown charts, and CSV export.

Finance Tool

Interest Calculator

Calculate simple and compound interest with growth charts and year-by-year breakdowns.

Developer Tool

Text Diff Tool

Compare two texts with color-coded additions, deletions, and changes. Side-by-side view.

Developer Tool

Regex Tester

Test regex patterns with live highlighting, capture groups, substitution, and cheat sheet.