JWT Decoder
Decode and debug JSON Web Tokens, see when they expire, and verify HS, RS, PS, ES, and EdDSA signatures.
Secure Password Generator
Generate strong random passwords and passphrases. Free, private, and 100% in your browser.
Type
Password Options
Your Password
Very strong≈ 130 bits of entropy
Time to crack at 100 billion guesses per second: far longer than the age of the universe
Create Strong, Random Passwords
The strongest password is one that nobody, including you, could have guessed: long and truly random. Humans are bad at choosing random passwords, so this generator lets your browser's cryptographic random number generator do it. Store the result in a password manager and use a different password for every account.
Features
Cryptographically secure
Every character comes from crypto.getRandomValues with rejection sampling, so there is no bias toward any character.
Passwords and passphrases
Random passwords from 4 to 128 characters, or passphrases of 3 to 12 random words that are easier to remember.
Full control
Choose character types, require one of each, avoid look-alike characters such as l, 1, O, and 0, or exclude any character.
Strength you can trust
See the real entropy in bits and how long a fast offline attack would take, not a guess based on patterns.
Bulk generation
Create up to 50 passwords at once and copy them individually or all together.
Never stored or sent
Passwords exist only in this page's memory. Nothing is saved, logged, or transmitted.
How to Generate a Secure Password
- Choose Password for random characters or Passphrase for random words.
- Set the length or number of words. The strength meter updates instantly.
- Adjust the character types, or exclude characters a system does not accept.
- Copy the password into your password manager. Click Generate New for another one.
Frequently Asked Questions
Is this password generator safe to use?
Yes. Passwords are generated in your browser with the Web Crypto API's cryptographically secure random generator. They are never sent over the network, saved, or logged. Closing the page erases them.
How long should my password be?
For accounts protected by a password manager, use at least 16 random characters with all character types, which gives around 100 bits of entropy. Never reuse a password across sites.
What is password entropy?
Entropy measures how unpredictable a password is, in bits. Each extra bit doubles the number of guesses an attacker needs. Around 60 bits resists online attacks, and 80 bits or more resists offline attacks on stolen password hashes.
Password or passphrase: which is better?
Both are secure when they are random and long enough. Random character passwords are shorter for the same strength and ideal for password managers. Passphrases such as Snack-Ghost-Puppy-Coyote-Monk-Raven-Tulip are easier to remember and type, for example for a master password or a device login.
How is the crack time calculated?
It assumes an attacker who knows exactly how the password was generated and can test 100 billion guesses per second, which is realistic for fast hashes on modern GPUs. On average, half of all possibilities must be tried. Slow hashes such as bcrypt or Argon2 make real attacks far slower.
Related Tools
JWT Encoder
Create and sign JSON Web Tokens with HS256, RS256, ES256, PS256, or EdDSA, and generate test key pairs.
Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes and HMACs of text or files, live as you type.
Bcrypt Generator
Hash passwords with bcrypt at any cost factor and verify a password against an existing bcrypt hash.