Generate cryptographically-secure passwords or memorable passphrases. 100% local — nothing is sent anywhere.
This tool runs 100% in your browser. All computation happens locally on your device — your input is never uploaded to any server. Results are for reference only.
Strength is entropy — the number of equally likely guesses an attacker must try. Each random character adds log₂(alphabet size) bits; each random word from a list adds log₂(list size). Both grow strength exponentially, but only a passphrase stays memorable.
A 12-char random password from 94 symbols ≈ 79 bits. Four random words from a 7,776-word list ≈ 51 bits. Both dwarf a memorable 8-letter word (a few thousand guesses).
A developer needs an admin password (stored in a vault) and a login passphrase (typed often).
A strong password uses 16+ characters with uppercase, lowercase, numbers, and symbols. Set your rules and generate unlimited passwords — all created locally with Web Crypto API.
FreeToolHub Password Generator is a free browser-based tool that creates cryptographically secure passwords with entropy meter, no signup.
Generate cryptographically secure passwords. Custom length, character sets, exclude ambiguous chars. Built-in entropy meter. Free, no signup.
This generator creates cryptographically secure passwords from the browser's security-grade random source, with full control over length from 4 to 128 characters and which sets to include — uppercase, lowercase, digits, and symbols. An exclude-ambiguous toggle removes look-alike characters like l, 1, I, O, and 0 so passwords stay readable when handwritten or spoken over the phone, and a per-generation strength meter estimates entropy in bits so you can see the difference between 12 and 16 characters instantly. Nothing is transmitted: passwords exist only in your tab until you copy them into your password manager.
Anyone setting up new accounts who wants unique per-site passwords without paying for a generator app. System administrators provision device and service credentials where predictable patterns are a liability. Families setting up shared streaming and banking logins get speakable, unambiguous passwords with the ambiguous-character filter. Developers needing random secrets for API keys and signing tokens at prototype scale grab them here. Users in restricted environments — no installs allowed — get a zero-install option that runs entirely in the page.
(1) Set the length slider — longer is stronger, and 16+ is the modern recommendation. (2) Toggle character sets; requiring all selected sets guarantees at least one of each. (3) Enable exclude ambiguous to strip 0/O/1/l/I confusion characters. (4) Generate and copy; the entropy meter updates live, showing bits of randomness and a qualitative rating. The generator uses rejection sampling over crypto random values, avoiding the modulo bias that weaker implementations introduce, and never reuses or logs output.
Length has decisively beaten symbol-soup complexity. Modern offline attacks use GPU rigs and cloud fleets that try hundreds of billions of hashes per second against leaked databases, and an 8-character password — even with digits and symbols — falls in hours. A 16-character random password from a full character set carries roughly 100 bits of entropy and remains infeasible to brute-force for the foreseeable future; 20+ characters is effectively permanent. Passphrases of 4–6 random words reach similar strength with better memorability. Pair any password with a manager so every site gets a unique value, enable two-factor authentication on important accounts, and check your existing passwords against known breaches — reuse, not length, causes most account takeovers.
Strength comes from unpredictability, not complexity theater. Length dominates: a 12-character random password is strong, 16 is strong against well-resourced attackers, and 20+ is beyond any realistic brute force — each added character multiplies the search space more than any cleverness in character choice. Randomness source matters as much: this generator uses the Web Crypto API's cryptographically secure randomness, not Math.random(), which is predictable and has produced real vulnerabilities in sites that misused it. The passphrases mode deserves special mention — four random words give roughly 50 bits of entropy while staying typeable and memorable, which is why they are the recommended format for your master password and anything typed by hand. Generated passwords never leave the browser and are not stored; generating on the site where you will use the password means the secret exists in exactly one place until you paste it.
16 characters of random mixed characters is a strong default for accounts; 20+ where paranoia is warranted. For passphrases, four to five random words. Length beats symbol soup — a long passphrase outperforms a short password with special characters.
No. Generation uses the browser's Web Crypto API locally, the result displays once, and nothing is transmitted or saved — refresh and it is gone. Copy it straight into your password manager; that is the only place it should live.
For a vault master password or anything guarding high-value accounts, use 16+ characters with all character classes — about 100 bits of entropy, beyond any realistic brute force. For day-to-day logins managed by a password manager, 12-16 characters is a sound floor. Length beats cleverness: every added character multiplies the guesses required.
Passphrases for anything you type often (a 4-word EFF passphrase is about 51 bits and stays memorable); random passwords for anything stored in a manager and typed never (20 characters is roughly 130 bits). The trap is the middle ground — Tr0ub4dor-style substitutions look strong but carry less entropy than three random words.
The EFF short word list — 7,776 common English words, chosen so every word is short, familiar, and typeable. Each random word adds about 12.9 bits of entropy, so four words give roughly 51 bits, five words 64 bits. Capitalization and an appended number add a little more without hurting memorability.
No. Generation uses crypto.getRandomValues entirely inside your browser tab, and nothing is transmitted, logged, or saved — closing the tab erases the result. That is also why you should save a generated password into your password manager immediately: we could not recover it for you even if we wanted to.
Yes. The generator uses the Web Crypto API's getRandomValues() method, which draws from the operating system's cryptographically secure random number generator (CSPRNG). This is the same security standard used by banks and government systems. Each character is selected independently with uniform distribution.
Minimum 16 characters for sensitive accounts (banking, email), 20+ for password manager vaults. A 16-character password with uppercase, lowercase, digits, and symbols has ~96 bits of entropy—effectively uncrackable by current hardware (would take billions of years). The built-in entropy meter shows real-time strength assessment.
Yes. Enable "Exclude ambiguous characters" to remove visually similar characters: 0/O, 1/l/I, and similar pairs. This is useful when passwords must be read aloud or typed manually. You can also customize which character sets to include (uppercase, lowercase, digits, symbols).
This tool is also known by these tasks — each link opens the same tool with a focused guide:
Why did the fish get bad grades?
No signups, no data sold. The core of every tool is free forever — the optional Pro plan adds batch processing, unlimited downloads, white-label exports and an ad-free experience.
☕Support me on Ko-fi— keep tools free100% of proceeds go towards hosting & building more free tools.