Free Password Generator — Passphrase & Strength Checker
Generate strong random passwords, create memorable passphrases, or check how strong your existing password is — all free. 1Password charges for this.
About This Tool
Three tools in one — password, passphrase, and strength checker
Most password generators only create random character strings. 1Password and Dashlane lock passphrase generation and strength analysis behind paid subscriptions. This tool gives you all three modes free — with no login, no account, and no ads in the tool.
Everything runs locally. Your passwords are never sent anywhere. The Strength Checker uses entropy math to estimate real crack times — not a vague "weak/strong" bar.
Random Password
Customisable length (6–64 chars) with uppercase, lowercase, digits, symbols.
Passphrase Generator
4+ random words with separator options — easy to remember, hard to crack. Free (1Password charges).
Password Strength Checker
Paste any existing password — get entropy bits, online/offline crack time, and weakness list.
100% Private
All generation and analysis runs in your browser. Nothing leaves your device.
Quick Start
How to Use the Password Generator
Choose Mode
Select Password (random string), Passphrase (word combo), or Strength Checker (analyse existing).
Set Options
Adjust length, character types, word count, or separator depending on the mode.
Generate
Password and passphrase generate instantly on option change. Strength Checker analyses as you type.
Copy & Use
One-click copy to clipboard. Store in a password manager for safe keeping.
Reference
Password vs Passphrase — Which Should You Use?
| Attribute | Random Password | Passphrase |
|---|---|---|
| Example | kX!8rP@2nQvT | cloud-river-maple-brave |
| Entropy (typical) | ~78 bits (12 chars) | ~44 bits (4 words) |
| Memorability | Very hard | Easy |
| Typing speed | Slow (special chars) | Fast (words) |
| Best for | Password manager stored | Master passwords, device login |
Use Cases
When to Use Each Mode
Different account types need different credential strategies. Here is when to use each mode.
New Account Setup
Generate a unique strong password for every new account — prevents a single breach from cascading.
Master Password
Use the passphrase generator for password manager master passwords — memorable but high entropy.
Check Existing Password
Paste your current password into Strength Checker to see if it needs upgrading before a breach happens.
Work & SaaS Tools
Generate separate passwords for every business tool — Slack, Notion, cloud consoles, CRMs.
Server & Admin Accounts
Use 32–64 character random passwords for SSH keys, database root, and admin panels.
Security Audits
Use the strength checker to bulk-verify team passwords during a security review without storing them.
FAQ
Frequently Asked Questions
A passphrase is a sequence of random words — for example, cloud-river-maple-brave. Four random words give roughly 44 bits of entropy, which is equivalent to a fully random 7-8 character password but far easier to type and remember. NIST recommends passphrases for any password a human must memorise, such as a password manager master password.
Strength is measured in entropy bits: password length × log2(character pool size). The pool grows with each character set added — lowercase adds 26, uppercase adds 26, digits add 10, symbols add ~32. A 16-character password using all four sets has roughly 105 bits of entropy — effectively uncrackable.
Yes. The Strength Checker runs entirely in your browser — your password is never transmitted to any server. You can disconnect from the internet and it still works.
Crack time estimates how long a brute-force attack would take. Online attack (10 guesses/second) simulates a rate-limited login form. Offline attack (1 billion/second) simulates an attacker who has already stolen a hashed password database and is cracking it locally on fast hardware.
12 characters minimum for general accounts, 16+ for email, banking, or password manager master passwords. A 20-character password using all character types would take longer than the age of the universe to crack offline.
Always. Credential stuffing attacks take a leaked username/password pair from one breach and try it on thousands of other sites. Unique passwords per account completely neutralise this attack.