Generate cryptographically-secure passwords or memorable passphrases. 100% local — nothing is sent anywhere.
This tool runs 100% in your browser. All computation happens locally on your device — your input is never uploaded to any server. Results are for reference only.
Strength is entropy — the number of equally likely guesses an attacker must try. Each random character adds log₂(alphabet size) bits; each random word from a list adds log₂(list size). Both grow strength exponentially, but only a passphrase stays memorable.
A 12-char random password from 94 symbols ≈ 79 bits. Four random words from a 7,776-word list ≈ 51 bits. Both dwarf a memorable 8-letter word (a few thousand guesses).
A developer needs an admin password (stored in a vault) and a login passphrase (typed often).
A strong password uses 16+ characters with uppercase, lowercase, numbers, and symbols. Set your rules and generate unlimited passwords — all created locally with Web Crypto API.
FreeToolHub Password Generator is a free browser-based tool that creates cryptographically secure passwords with entropy meter, no signup.
Generate cryptographically secure passwords. Custom length, character sets, exclude ambiguous chars. Built-in entropy meter. Free, no signup.
This generator creates cryptographically secure passwords from the browser's security-grade random source, with full control over length from 4 to 128 characters and which sets to include — uppercase, lowercase, digits, and symbols. An exclude-ambiguous toggle removes look-alike characters like l, 1, I, O, and 0 so passwords stay readable when handwritten or spoken over the phone, and a per-generation strength meter estimates entropy in bits so you can see the difference between 12 and 16 characters instantly. Nothing is transmitted: passwords exist only in your tab until you copy them into your password manager.
Anyone setting up new accounts who wants unique per-site passwords without paying for a generator app. System administrators provision device and service credentials where predictable patterns are a liability. Families setting up shared streaming and banking logins get speakable, unambiguous passwords with the ambiguous-character filter. Developers needing random secrets for API keys and signing tokens at prototype scale grab them here. Users in restricted environments — no installs allowed — get a zero-install option that runs entirely in the page.
(1) Set the length slider — longer is stronger, and 16+ is the modern recommendation. (2) Toggle character sets; requiring all selected sets guarantees at least one of each. (3) Enable exclude ambiguous to strip 0/O/1/l/I confusion characters. (4) Generate and copy; the entropy meter updates live, showing bits of randomness and a qualitative rating. The generator uses rejection sampling over crypto random values, avoiding the modulo bias that weaker implementations introduce, and never reuses or logs output.
Length has decisively beaten symbol-soup complexity. Modern offline attacks use GPU rigs and cloud fleets that try hundreds of billions of hashes per second against leaked databases, and an 8-character password — even with digits and symbols — falls in hours. A 16-character random password from a full character set carries roughly 100 bits of entropy and remains infeasible to brute-force for the foreseeable future; 20+ characters is effectively permanent. Passphrases of 4–6 random words reach similar strength with better memorability. Pair any password with a manager so every site gets a unique value, enable two-factor authentication on important accounts, and check your existing passwords against known breaches — reuse, not length, causes most account takeovers.
Yes. The generator uses the Web Crypto API's getRandomValues() method, which draws from the operating system's cryptographically secure random number generator (CSPRNG). This is the same security standard used by banks and government systems. Each character is selected independently with uniform distribution.
Minimum 16 characters for sensitive accounts (banking, email), 20+ for password manager vaults. A 16-character password with uppercase, lowercase, digits, and symbols has ~96 bits of entropy—effectively uncrackable by current hardware (would take billions of years). The built-in entropy meter shows real-time strength assessment.
Yes. Enable "Exclude ambiguous characters" to remove visually similar characters: 0/O, 1/l/I, and similar pairs. This is useful when passwords must be read aloud or typed manually. You can also customize which character sets to include (uppercase, lowercase, digits, symbols).
This tool is also known by these tasks — each link opens the same tool with a focused guide:
What do you call a crab that plays baseball?
No paywalls, no signups, no data sold. Built by a solo developer who believes useful tools should be accessible to everyone.
☕Support me on Ko-fi— keep tools free100% of proceeds go towards hosting & building more free tools.