Generate strong passwords, passphrases, PINs & WiFi keys
Uses current mode settings (Random/Passphrase/PIN/Pronounceable)
This is more than a basic password generator — it's a complete credential creation toolkit. Generate cryptographically random passwords using the Web Crypto API, create memorable passphrases from a curated wordlist, produce numeric PINs, or build pronounceable passwords that balance security with usability. The crack time estimator models real attack scenarios: from online brute-force (10 guesses/second with rate limiting) to massive GPU rigs (1 trillion guesses/second). Every password is generated locally using crypto.getRandomValues() — the gold standard for unpredictable randomness. Nothing is ever transmitted or stored beyond your current browser session.
Random for maximum security (bank accounts, email). Passphrase for passwords you need to type manually (WiFi, master passwords). PIN for numeric codes. Pronounceable when you need something speakable over the phone or easy to remember temporarily.
At minimum 12 characters for random passwords. For passphrases, 4+ words. Each additional character exponentially increases brute-force difficulty. A 16-character random password with all character types has ~105 bits of entropy — effectively uncrackable with current technology.
Yes — a 5-word passphrase from a 1,000+ word list provides ~50 bits of entropy, comparable to a 10-character random password. Passphrases are easier to remember and type. Adding capitalization, numbers, and symbols increases entropy further. The key is using truly random word selection, not choosing words yourself.
Entropy measures password randomness in bits. Each bit doubles the number of possible combinations. 40 bits = ~1 trillion combinations. 80 bits = ~1.2 × 10²⁴ combinations. For reference, 80+ bits is considered strong against offline attacks, and 128+ bits is practically unbreakable.
Yes. All generation uses your browser's built-in cryptographic random number generator (crypto.getRandomValues). No passwords are ever sent to any server, stored in cookies, or logged anywhere. You can verify by checking the Network tab in your browser's developer tools — zero outbound requests during generation.