Password Generator — Strong Passwords, Passphrases & PINs in Your Browser
Generate cryptographically secure passwords, passphrases, and PINs instantly. Everything runs in your browser — no signup, no tracking, no data leaves your device.
…
Strength: —
Crack time: —
Advanced options
Custom set (if non-empty, overrides the checkboxes above; filtering options still apply)
Word list: 2200 four- to seven-letter common words. Passphrases are built only in this tab.
How to Use the Password Generator
Open the Password tab, pick a length, and use the checkboxes to decide which character classes you allow, then add advanced filters if a site is picky. Switch to Passphrase to build several random common words, pick a separator (including a new random one between each word), and optionally add a short number or symbol. Use the PIN tab for all digits when a phone or device expects a short numeric code.
Click Copy when a value is ready; the button will briefly show confirmation and use the clipboard API on supported browsers. Use Regenerate to get a fresh value with the current settings, or Generate 10 at once when you are comparing a batch (each row has its own copy control).
What Makes a Password Strong?
Length and unpredictability are what matter: more bits of entropy, from a long random string or from several random words, makes brute-force guessing more expensive. An eight-character password that uses all classes can still be far easier to attack than a sixteen-character password made only of lowercase, if the sixteen are chosen with good randomness.
A single dictionary word is easy to guess, but a string of several random list words is not. Entropy, informally, is a measure of how many equally likely options an attacker has to try; more entropy is more resistance at a fixed attacker budget.
Passwords vs Passphrases — Which Is Better?
A random password (for example 16 symbols from a broad pool) is ideal when a password manager fills it in and you never have to retype it. A passphrase of random short words is often better when a human will speak or type it, such as a network key or a master you rarely enter. A rough check: on this page’s word list of about 2200 words, three random words give about 33 bits; four words about 44 bits. That is a useful ballpark, before optional digits or symbols.
Password Best Practices
- Never reuse a high-value password across two different accounts.
- Consider a reputable password category of tools (a manager with encryption) for storage—pick one you trust; we do not list affiliates here.
- Turn on two-step verification (2FA) everywhere it is available.
- Be careful with phishing: a strong password does not protect you if you type it on a fake site.
How Our Generator Works
This page calls crypto.getRandomValues(), a Web Crypto API that is meant for key material and other
security-sensitive use. It is a different class of function from Math.random(), which is not suitable for
secrets. Generation runs in your device memory only; the tool does not send the string over the network for
“strength analysis” or any other feature.
Privacy and Security Guarantees
No server work is required to produce a new password, passphrase, or PIN. We do not track individual strings in product analytics, do not store your output in a database, and do not use localStorage to remember generated values. You can review the public script in your browser’s developer tools; the tool should work offline after the first load in a typical static deployment.
FAQ
How does the password generator work?
A script in this page uses your browser’s Web Crypto API: the global crypto.getRandomValues() function fills a buffer of cryptographically strong random bytes, and the tool maps those to characters from the pool you allow (or to random words in passphrase mode, or to digits in PIN mode). The password is displayed only in your session’s memory. Nothing in this process sends your result to a server, database, or analytics system.
Is this password generator secure?
For producing unpredictable secrets, the important part is the random source. This tool does not use Math.random(), which is not suitable for security. It uses the same getRandomValues API that modern browsers use for other cryptographic tasks. The strength you get still depends on length, character or word choices, and how you store the password (for example in a password manager) after you leave the page.
Does this store the passwords I generate?
No. The site does not save generated passwords in localStorage, sessionStorage, or cookies, and the static page does not upload your output. When you close the tab, the value is gone. Copy and save it yourself if you need it later.
Can I use this for banking and financial accounts?
You can use it to create a strong, unique starting point, but a browser tool cannot replace a bank’s own security rules (for example on allowed characters or two-factor). Always enable two-factor authentication and follow your bank’s official guidance. Do not reuse this password for other services.
What's the difference between a password and a passphrase?
In this page, a password is a random string from letters, numbers, and symbols. A passphrase is a sequence of random common words, separated by a character of your choice. Both can be strong: short passwords with a large character set, or long passphrases with a large word list, can give high search space. Passphrases are often easier to read or dictate (for example for WiFi).
How long should my password be?
Longer is generally better than a short string with more symbol types. Many experts recommend at least 12–16 characters for general accounts when the system allows, and 16+ for long-lived credentials. A four-word random passphrase with a long word list can also be very strong, especially if the site has no arbitrary length cap.
Why avoid similar characters like 0/O?
Some typefaces make 0 (zero) and the letter O, or 1 and the letter l, look alike. In settings where a password is read and typed from paper or screen, excluding those characters can reduce the chance of confusion. The trade-off is a slightly smaller character pool, which you offset with length or extra word entropy.
Can this generate passwords offline?
After this page and its script have loaded, you can use the tool without a network. Generation does not need any request to our servers, because there is no “password API.” Clear your other tabs and avoid extensions that read page content if you are on an untrusted device.
What's cryptographically secure random?
It means the next output is impractical to predict from past outputs, assuming the browser’s implementation of getRandomValues is correct. It is a different class of function from Math.random() in JavaScript, which is fast but not build for security. Browsers are expected to get seed material from the operating system.
How many passwords can I generate?
As many as you need in one session, including ten at a time in the list below, and by clicking Regenerate repeatedly. The page does not rate-limit you or charge per password. The only limit is that your session does not last forever, so keep what you need in your own manager or other secure storage.
About this tool: The Password Generator is built and maintained by DoItSwift. Random values come
from the browser’s crypto.getRandomValues() API, not from Math.random(). Nothing
you generate is sent to our servers. Use a password manager to store credentials you need to keep.