Create strong random passwords or memorable word passphrases with crypto randomness. Set length, symbols and word count, all private and offline.
Part of our Generators collection — Explore more Generators tools · See also: Lorem Ipsum Generator, Slug Generator.
Also available in: versión en español → · version française →
Quick answer: Password & Passphrase Generator — Strong passwords & passphrases Free, no signup, runs in your browser. See below for the interactive tool, 4-step guide and FAQs.
Length: 16
Deep dives from the Tool4SaaS blog — tested workflows, print sizes and fixes.
Reviewed by the Tool4SaaS Editorial Team — In-house reviewers who build and test every tool locally for accuracy across current Chrome, Edge, Firefox, and Safari. Last updated: . See our authors, methodology or contact us.
Two views share one tab bar. Password builds a random character string with adjustable length and symbol toggles, while Passphrase draws memorable words from a curated list. For example, a 20-character login like k9#Vm2$xQ8Lz! carries about 131 bits, while a four-word phrase such as bright-harbor-mango-orbit reads easily. Both copy in one click and clear when the tab closes.
Yes. Passwords draw from window.crypto with rejection sampling, never Math.random, so no sequence is predictable. Sixteen characters from 94 symbols give about 105 bits, twenty reach about 131 bits and thirty-two near 190 bits. Passphrases shuffle a 120-word list with an unbiased Fisher-Yates pass, so each of the words is equally likely to land in any slot.
A 120-word list supplies about 6.9 bits per word, so four words give roughly 28 bits, fine for forums and trials but light for vaults, while six words reach about 41 bits and seven about 48 bits for email, banking and crypto accounts. Offer the shorter phrase for casual logins and the longer one for master passwords, and store the winner in a manager rather than reusing it.
Aim for at least 16 characters with upper, lower, digits and symbols for logins, and 32 or more for API secrets and wallet keys. Length beats clever substitutions, since each extra character roughly doubles cracking effort, so 16 characters outperform a complicated 8-character trick. Keep symbols on for high-value accounts and paste results straight into a password manager.
Choose a passphrase when a human must type or remember the secret, such as a master password, a Wi-Fi key or a recovery phrase, because words are easier to key in without errors. Choose a random character string for API tokens, salts and nonces where maximum entropy per character matters and nothing is typed by hand. The tab bar switches between the two instantly.
Nothing is uploaded. Every value is generated locally in your browser and clears on close, so unreleased keys and drafts stay private. Rotate secrets after a departure, a suspected leak, a failed-login spike or a scheduled audit, then generate the replacements here in one batch and revoke the old tokens promptly. Reuse across sites invites credential stuffing after a single breach.
Two views centralize credential creation in one offline page. Password draws a random character string with adjustable length, symbol toggles and an exclude-similar switch, while Passphrase shuffles a curated word list into a memorable phrase. A 20-character login like k9#Vm2$xQ8Lz! carries about 131 bits; a four-word phrase such as bright-harbor-mango-orbit reads easily; and a 32-character secret approaches 190 bits. Reference table: 16 characters equal 105 bits, 20 equal 131 bits, 32 equal 190 bits, and four words equal about 28 bits. Everything copies in one click.
Each character comes from window.crypto with rejection sampling, which discards out-of-range draws so every symbol is equally likely, unlike predictable Math.random sequences. Adding symbols expands the alphabet to 94 and lifts strength per character, so length still beats substituting zero for the letter o. Passphrases use the same source to run an unbiased Fisher-Yates shuffle, giving each of the 120 words about 6.9 bits. Limitation: some sites cap length or forbid symbols, so match the toggles to the policy before submitting, and treat passphrase entropy as lower per character than a full random string.
Provision an account: set length 20 with all sets on, copy k9#Vm2$xQ8Lz! into the vault, then mint a 32-character API secret in the same batch. For a Wi-Fi key a human types, switch to Passphrase, choose four words and store bright-harbor-mango-orbit. Edge case: enabling exclude-similar drops the confusing i, l, 1, L, o, 0 and O while keeping full strength. After any leak, regenerate replacements here and revoke the old tokens immediately. To gauge a value you already hold, paste it into the password strength checker.