Free privacy tool

Free password generator

Create strong, unguessable passwords and passphrases in your browser. Nothing is sent to our servers: every password is generated and shown on your device.

Your new password

Strength

Length20

UppercaseA-Z Lowercasea-z Numbers0-9 Symbols!@#$%^&* Exclude ambiguous characters0, O, 1, l, I

Words5

Separator

Capitalise each wordCorrect-Horse Include a numberadds 0 to 999 at the end

100% private. Nothing you generate touches our servers. Open your developer tools and check the network tab to verify.

Generated on your device
Uses your browser's secure random generator
Nothing sent or stored
Free, no sign-up

Why strong passwords

Length beats complexity

A 16-character password made only of lowercase letters is harder to crack than an 8-character password mixing upper case, numbers and symbols. Every extra character multiplies the number of possible combinations.

Aim for at least 16 characters. 20 or more is better, and with a password manager filling it in for you, there's no reason not to.

Random beats clever. Swapping letters for numbers, like p@ssw0rd, is the first thing cracking tools try.
One account, one password. A strong password used twice is only as safe as the weaker of the two sites.

How long it would take to guess

8 characters, all four setsAbout 60 minutes
16 characters, lowercase onlyAbout 1 thousand years
6-word passphrase with a numberAbout 3 thousand years
12 characters, all four setsAbout 7 thousand years
16 characters, all four setsAbout 410 billion years
20 characters, all four setsEffectively impossible

Estimates from the same model the generator uses: truly random characters or words, and an attacker making one trillion guesses a second. Real attacks vary, so treat these as a guide.

Tips

Four habits that matter more than any one password

Use passphrases for what you type

A few random words strung together, like correct-horse-battery-staple, are far easier to remember and type than random characters. Cracking tools lean on dictionaries and common substitutions, but truly random word combinations hold up. Use six or more words for anything important.

Never reuse passwords

When a website you use is breached, and given enough time most are, attackers try the leaked email and password pairs on every other service. This is called credential stuffing, and it's how many account takeovers happen. Every account needs its own password.

Use a password manager

The only realistic way to have a unique strong password for every account. Bitwarden, 1Password and KeePass are all solid options. Your browser's built-in manager is a reasonable start, though dedicated managers offer better cross-device sync and security checks.

Turn on two-factor authentication

Even the strongest password can be phished, keylogged or stolen. Two-factor authentication with an authenticator app such as Aegis or Authy adds a second step attackers can't easily get past. Turn it on everywhere you can, especially email, banking and cloud storage.

More free tools

Other ways to stay private online

Share a password

Send a password through a link that self-destructs after it's read.

Encrypted notes

Write a private note, encrypted in your browser, and share it with a link.

IP leak test

See what every website can see about your connection.

Browser fingerprint

Find out how unique your browser looks to the sites you visit.

PremierVPN

Strong passwords are only part of the story

A password protects your accounts. A VPN protects your connection: the network you're on, the sites you visit and the data you send. Premium also includes a Security Dashboard that alerts you when a password of yours turns up in a breach.

See plans Security Dashboard

Questions

About the password generator

Is this password generator safe to use?

Yes. Passwords are made in your browser using its built-in cryptographic random number generator (crypto.getRandomValues) and are never sent to our servers. Open your browser's developer tools and watch the network tab while you generate to check for yourself.

How long should a password be?

At least 16 characters, and 20 or more is better. Every extra character multiplies the number of possible combinations, so length does more for strength than adding symbols to a short password.

Should I use a random password or a passphrase?

If a password manager fills it in for you, use a long random password. If you have to remember it or type it, such as your computer login or the master password for your password manager, a passphrase of six or more random words is easier to get right and still strong.

What does "exclude ambiguous characters" do?

It leaves out 0, O, 1, l and I, which look alike in many fonts. That makes a password easier to read aloud or type from paper, at the cost of a slightly smaller character pool.

How is the strength worked out?

The meter estimates entropy from the size of the character pool (or word list) and the length, then works out how long it would take to try every combination at one trillion guesses a second. Real attacks vary, so treat it as a guide rather than a guarantee.

Do you store the passwords I generate?

No. Nothing you generate touches our servers. The password only exists on your screen until you copy it or close the page.