Password Generator

Generate a strong random password, a memorable passphrase or a PIN in your browser. Real entropy and crack-time figures, nothing sent to a server.

Last updated: 2026-07-26

Three modes, for three different jobs

Most password tools give you one slider and a character-class checklist. That covers the common case and fails the other two, so this generator has three modes and the strength readout adapts to whichever you pick.

Random — a dense string of letters, digits and symbols. Use this everywhere a password manager does the typing, which should be almost everywhere
Passphrase — random words joined by a separator, drawn from a 7,776-word list at 12.9 bits each. Use it where a human types it from memory: a device unlock, a master password, a console login
PIN — a uniformly random numeric code for a card, phone, safe or alarm panel, where the keypad only has digits

How the passwords are generated

Every character comes from crypto.getRandomValues, the browser's cryptographically secure random number generator. Nothing here uses Math.random, which is seeded from the clock and produces sequences an attacker can reproduce — fine for shuffling a playlist, useless for a secret.

Picking a character from the alphabet uses rejection sampling rather than a modulo. Writing randomValue % alphabetLength is the obvious approach and it is subtly biased: because 2^32 is not divisible by most alphabet sizes, the first few characters of the set come up slightly more often than the rest. The bias is small, but it is a real reduction in the search space an attacker has to cover, so the generator discards values that would land in the uneven tail and draws again.

Generation happens entirely in your browser. No password is sent to a server, logged, or stored — there is nothing to breach, because nothing leaves the page. Closing the tab is all it takes to destroy every password you generated.

What the entropy figure actually measures

The bits shown under each password describe the generator, not the string it produced. That distinction matters more than it sounds.

Most strength meters score the output: they look for an uppercase letter, a digit, a symbol, and award points. By that measure "aA1!" scores four character classes and reads as strong, when it is four characters an attacker exhausts in microseconds. Scoring the settings instead gives the honest number — how large a space the password was drawn from, which is what an attacker actually has to search.

The formula is length multiplied by log2 of the alphabet size. Sixteen characters over the full 88-symbol set is 16 × log2(88), or about 103 bits. Drop symbols and the alphabet falls to 62, so the same length gives about 95 bits. Every character you add is worth more than every rule you satisfy.

The crack-time estimate assumes 100 billion guesses per second — a defensible figure for an offline attack on a fast hash with commodity GPUs — and halves the keyspace, because the average break lands midway through rather than at the end. Against a well-configured site that rate-limits logins, real attacks are far slower; the estimate deliberately assumes the attacker already has the password database.

What the strength meter will and will not tell you

The bit figure here is measured from the settings you chose — length and alphabet, or word count and wordlist size — not from the characters that happened to come out. That distinction matters. A meter that scores the output string rewards a password like Aa1! for containing four character classes, when it is four characters of guessing and falls in seconds.

The bands are the conventional ones and are deliberately not tuned to flatter this tool. A four-word passphrase reads Fair rather than Strong. A six-digit PIN reads Very weak, because 20 bits is genuinely weak against anything that is not rate-limited — a PIN's security comes from the lock allowing three attempts, not from the number itself.

Where to put the password once you have it

A generated password is only useful if you can retrieve it. The honest answer for most people is a password manager — it removes the need to remember anything except one master credential, and it fills passwords only on the domain they belong to, which quietly defeats most phishing.

If you are not going to use one, write the password down and keep the paper somewhere physical and private. A note in a drawer is a better outcome than a memorable password reused across accounts, because the realistic threat to your accounts is a credential-stuffing bot working through a leaked database, not a burglar reading your desk.

Never reuse a password across sites — one breach then unlocks everything
Turn on two-factor authentication where it is offered; it protects you even if the password does leak
Change a password when a service discloses a breach, not on a fixed schedule — forced rotation pushes people toward predictable patterns
Treat security questions as passwords too, and generate answers rather than using real ones

How to use the Password Generator

Set Length: Go to fixflowhub.com/password-generator and set desired password length
Choose Characters: Select character types — uppercase, lowercase, numbers, symbols
Generate: Click Generate to create a cryptographically secure password
Copy: Copy the password and save it in your password manager

Frequently Asked Questions

Are the passwords generated on my device?

Yes. Everything runs in your browser using the Web Crypto API, and no password is transmitted, logged or stored. You can disconnect from the internet after the page loads and keep generating — a reasonable way to satisfy yourself that nothing is being sent.

How long should a password be?

Sixteen characters is a sensible floor and twenty is better, provided a password manager does the typing. Length buys far more than adding another symbol type does: every extra character multiplies the search space by the size of the alphabet.

Random string or passphrase?

A random string wherever software fills it in, because it is shorter and denser for the same strength. A passphrase wherever a human types it from memory — a phone unlock, a password-manager master password, a machine you log into at a keyboard.

Is this safer than making up my own password?

Substantially. Human-chosen passwords cluster hard around names, dates, keyboard runs and word-plus-number patterns, which is exactly what cracking tools try first. A generated password has no such structure to exploit.

Do you store or log anything I generate?

No. There is no server call involved in generating a password, so there is nothing to store. The page has no account system and does not send the output anywhere.

How is the strength figure calculated?

It is log2 of the number of possibilities the generator could have produced: length times log2 of the alphabet for a random password, word count times log2 of the 7,776-word list for a passphrase. It measures the generator, not the string, which is the only honest way to do it.

What is the crack time based on?

100 billion guesses per second — an offline attack against a stolen password database using commodity GPUs — and the keyspace is halved, because the average break lands midway rather than at the end. Against a site that rate-limits logins, real attacks are thousands of times slower.

Can I generate several passwords at once?

Yes. The bulk buttons produce 5, 10, 25 or 50 at a time and let you download them as a text file, which is useful when setting up accounts in batch. Delete the file once the passwords are in your manager.

What makes a password strong?

Length and unpredictability, in that order. Every extra character multiplies the number of possibilities by the size of the alphabet, which is why sixteen random characters beats eight clever ones by an astronomical margin. What does not make a password strong: substituting 3 for e, appending a year, or any pattern a human chose deliberately — cracking tools try those first.

Is this password generator free?

Yes, entirely. No account, no limit on how many you generate, no watermark and no paid tier. Nothing is generated on a server, so there is no cost to pass on.

Should I reuse a strong password across sites?

No. Reuse is the single most damaging habit in password security: when any one site is breached, attackers replay the same email and password against banks, email and shopping sites automatically. A strong password used in three places gives you the security of the weakest of those three sites.

Related free tools

More free utility tools