Free Password Generator

Why use a strong, unique password?

Most account breaches start with a weak or reused password. The single best defence is a long, random password that you never use anywhere else — so that even if one site is breached, the leak can’t be used to open your other accounts. A generator removes the temptation to invent a "memorable" (and therefore guessable) password.

What makes a password strong?

• Length first. Every extra character multiplies the time to crack it. Aim for 16+.
• Mix character types — uppercase, lowercase, numbers, and symbols.
• Never reuse it. One unique password per site, ideally stored in a password manager.
• Randomness matters. Patterns and substitutions (like P@ssw0rd) are the first things cracking tools try.

Is this generator private?

Yes. Passwords are generated locally using your browser’s cryptographically secure random number generator (the Web Crypto API). They are never transmitted, logged, or stored on our servers — when you close the tab, they’re gone. That’s the same privacy-first principle behind our disposable email service.

How this generator works

Each time you click generate, the page asks the browser for random bytes through crypto.getRandomValues(), then maps each byte onto the character sets you ticked. Rejection sampling is used so that every allowed character has exactly the same probability; a naive byte modulo alphabet length approach would subtly favour some characters and weaken the result. The length slider controls how many characters are drawn, and unticking a set simply removes it from the alphabet.

How long would it take to crack?

Strength is usually expressed in bits of entropy: the number of equally likely passwords the attacker has to try, written as a power of two. A 16-character password drawn from all four sets (about 94 symbols) has roughly 105 bits of entropy. Even at a trillion guesses per second, exhausting that space would take longer than the age of the universe. By comparison, an 8-character password from the same alphabet has about 52 bits and can fall to a modern GPU rig in days, and a dictionary word with a digit on the end falls in seconds.

• 12 characters, letters only: about 68 bits. Acceptable for low-value accounts.
• 16 characters, all sets: about 105 bits. Our default, suitable for email and banking.
• 24 characters, all sets: about 157 bits. Use for password-manager master passwords and encryption keys.

Tips for managing the passwords you generate

• Store them in a password manager rather than a note or a spreadsheet, so that you only ever memorise one strong master password.
• Turn on two-factor authentication where it is offered; a strong password protects against guessing, while a second factor protects against phishing and leaks.
• If a site caps password length or bans symbols, generate the longest password it allows and leave symbols unticked instead of shortening a good one by hand.
• Change a password only when you have a reason to, such as a breach notice. Forced periodic rotation tends to produce weaker, patterned passwords.

Pair it with a disposable email

A strong password protects the account; a disposable email protects your identity and inbox when you sign up. Together they’re a simple, powerful privacy combo for any throwaway account.