How random are the passwords?

Passwords are generated with window.crypto.getRandomValues — the browser's cryptographic randomness source, the same one used in encryption. We also remove modulo bias when picking characters, so every combination is equally likely. This is not the predictable Math.random pseudo-randomness.

Is the password sent to your server?

No. Everything is computed right in your browser in JavaScript; not a single character of the password goes over the network. We physically never see generated passwords and store nothing — reload the page and the result is gone.

How long should a password be?

For most sites 16 characters with all sets is enough. For especially important accounts (email, banking, password manager) use 20 or more, or a passphrase of 5–6 words. Length adds strength faster than tacking on individual special symbols.

What does “crack time” mean?

It's a rough estimate of how long it would take to guess the password by brute force in an offline attack against a fast hash (on the order of 100 billion guesses per second). It reflects resistance to brute force but not other threats: a dictionary, reused or leaked password is cracked instantly no matter how long it is.

Why is a passphrase better than a password?

It's easier to remember and dictate, and with enough random words it's just as strong as a long password. A passphrase is handy where you have to type or remember the password by hand — for example a manager's master password or a disk encryption key.

Should I change passwords regularly?

Changing them “just in case” is no longer recommended — it pushes people toward weak, predictable passwords. Change a password if it might be compromised: it appeared in a breach, was entered on a suspicious site, or was reused across services. What matters more is a unique password for each account.

Strong password generator

Create a strong random password or a memorable passphrase with no signup. Pick the length and character sets — we show the strength and an estimated crack time alongside. Everything is generated right in your browser with a cryptographic generator and never leaves your device.

The password is generated locally in your browser (window.crypto) — nothing is sent to a server or stored. Reload the page and it's gone for good.

A password is already generated below. Tune the length and characters to fit the site's rules, hit “Refresh” for a new one, and copy the result.

StrengthWeak

Entropy: 0 bitsBrute-force time: instantly

An estimate for an offline brute-force attack against a fast hash (~100 billion guesses/sec). It's a rough measure of resistance to guessing, not a guarantee: a dictionary word or a leaked password is cracked instantly no matter how long it is.

Password length16

Generated entirely in your browser — the password never leaves your device.

What makes a password strong

A password's strength comes not from looking “complex” but from entropy — its length and the size of the character set. The more of both, the more combinations an attacker has to try.

Length beats symbols

Every extra character multiplies the number of combinations. A 16-character password is stronger than a short 8-character one, even if the latter is packed with special symbols. Aim for 16 characters or more.

Randomness

The password is generated from a cryptographic source (window.crypto), not a predictable pseudo-random function. No patterns, dates or dictionary words — just an even, unbiased choice.

Unique per site

Even the strongest password is useless if you reuse it: one leak exposes every account. Generate a separate password for each service.

When it helps

Signing up for a new site

Quickly create a strong password that isn't reused anywhere, then save it straight into your password manager.

Replacing a compromised password

If a password showed up in a breach, replace it with a fresh random one — the old one can no longer be considered secret.

A passphrase you can remember

For a manager's master password or Wi-Fi, a phrase of random words is handy: easier to remember and dictate, with the strength of a long password.

Ready to try?

Download LiMP VPN for free and feel the difference within a minute.

Download for AndroidGet the Chrome extension

What a strong password really is

A password's strength is measured not by how “scary” it looks but by how many combinations you'd have to try to guess it. That count is called entropy and is measured in bits: each extra bit doubles the number of possibilities. A random, high-entropy password resists brute force; a short one or one based on a dictionary word does not, even with a few digits and symbols added.

This generator builds the password from a cryptographic randomness source right in your browser and immediately shows its entropy and estimated crack time, so you can see real strength instead of relying on a gut feeling.

Password or passphrase — which to choose

A random character password is compact and maximally strong per character. It's ideal for sites and services where the password lives in a manager and you never type it by hand.
A passphrase of several random words is easier to remember and dictate, yet just as strong as a long password. It suits a manager's master password, disk encryption or Wi-Fi.
In both cases what matters is randomness and length. A “clever” phrase with meaningful text is far weaker than a few genuinely random words.

How to store passwords safely

Even a perfect password is pointless if it's the same across sites: one service's leak hands an attacker the rest (this is called credential stuffing). So every account needs its own unique password — remembering dozens of random strings is impossible, and that's fine.

The answer is a password manager: it keeps every password encrypted, and you only need to remember one master password (a passphrase works well for that). Wherever you can, turn on two-factor authentication — it protects the account even if the password does leak.

Is it safe to generate a password online

With this tool, yes: the whole password is created locally in your browser via window.crypto (the same cryptographic source encryption protocols use) and is never sent anywhere. We don't see generated passwords, don't log them and don't store them — reloading the page wipes the result for good.

The general advice still holds: for an important account it's best to generate the password inside your own password manager and save it there right away. This generator is handy when a manager isn't at hand or you need a quick strong password that you'll immediately store somewhere.