Password Generator
Generated on your device with Web Crypto

Passwords that are actually hard to guess

Create cryptographically strong passwords and memorable passphrases, watch the real entropy while you tweak them, then keep them in a vault only your master passphrase can open.

Build a password

Every change regenerates instantly — tune until the meter feels right.

Passphrase mode
Join random dictionary words instead of characters.
Lowercase
a–z
Uppercase
A–Z
Digits
0–9
Symbols
!@#$%…
Exclude ambiguous characters
Drops letters and digits that look alike: I l 1 O 0 o.

Your password

Generated locally — never uploaded.

Choose your options and generate.
— —
WeakFairStrongExcellent

Your vault

Sealed with AES-GCM under a key derived from your master passphrase.

A vault starts as an empty, encrypted box. Choose a master passphrase — it is never stored, so only you can open it.

Create a vault

Use a passphrase you will not forget. There is no reset and no recovery email.

Your entries stay in this browser's local storage as ciphertext. Nothing is uploaded, and this site cannot read them. Browser storage can be cleared at any time, so keep an exported backup of anything important.

How it works

Three ideas do all the work: real randomness, length over clever substitutions, and encryption that only you hold the key to.

01

Randomness you can trust

Characters come from crypto.getRandomValues, the browser's cryptographic source, rather than a predictable Math.random sequence. No pattern, no seed, no bias.

02

Measured, not guessed

The meter reports true entropy in bits — the number of guesses an attacker would need. Longer passwords and bigger character sets raise it fast; lookalike swaps barely move it.

03

Saving that stays private

The vault derives a 256-bit key from your passphrase with PBKDF2 and seals entries with AES-GCM. The ciphertext lives in your browser; the passphrase is never stored.

Getting the most out of a password

Most breaches do not break cryptography — they exploit reuse, short passwords and phishable habits. A few rules cover the great majority of risk.

Length beats complexity

Each extra character multiplies the search space. Sixteen random characters is a solid default; twenty is better for anything that guards money or email.

One password, one account

Reuse is what turns a single leaked database into a cascade of account takeovers. A unique password everywhere means a breach stays contained.

Turn on two-factor auth

A strong password plus an authenticator app or hardware key is dramatically harder to break than either alone. Use it on email first.

Beware of “password checkers”

Any page that asks you to type an existing password is a phishing risk. Generate new passwords here, and never paste a live one into a site you do not control.

Frequently asked questions

Is this password generator safe to use?
Yes. Passwords are generated with the browser's Web Crypto API, which draws from the operating system's cryptographic random source, and nothing you type or generate is ever sent to a server. The page has no backend that stores your data.
How long should my password be?
For anything important, aim for at least 16 random characters, or a passphrase of five or six words. Length matters far more than swapping letters for symbols — every extra character multiplies the number of guesses an attacker needs.
Is a passphrase stronger than a random password?
Both can be strong when they are long enough. A six-word passphrase from a large word list carries roughly the same entropy as a twelve-character random password, and it is much easier to type on a phone. Use the entropy figure shown under the result to compare them.
How does the vault keep my passwords private?
Your master passphrase is never stored. A 256-bit key is derived from it with PBKDF2 and 210,000 iterations, and the entries are sealed with AES-GCM. The encrypted blob lives in your own browser storage, so nobody — including this site — can read it without the passphrase.
What happens if I forget my master passphrase?
There is no reset and no recovery email, because the passphrase is the only thing that can decrypt the vault. That is what makes it private. Keep an exported encrypted backup and the passphrase somewhere safe.
Does the vault replace a real password manager?
No. It is a convenient, self-contained scratchpad for a few credentials on one device. Browser storage can be cleared by the browser, and it does not sync or fill logins, so keep your permanent copy in a dedicated password manager.

Tip: generate the password here, save it to the vault, then paste it into the site you are creating it for. If your browser or a security tool flags the paste, type the first few characters and paste the rest.