Password Generator
Create strong random passwords, memorable passphrases and PINs. Free, no sign-up, and nothing you generate is ever sent or stored.
How to create a password that is actually strong
Pick Password, Passphrase or PIN, set the length and press Generate. The result appears immediately with a strength meter, so you can see how long it would take an attacker to guess it. Copy it into your password manager or the sign-up form, and generate a different one for every account. Everything happens inside your browser: nothing is sent to a server, nothing is stored, and the password is gone when you close the tab.
Why generated beats invented
People are predictable. We swap an a for @, add a 1 at the end, and use names and dates. Attackers know these habits and try them first. A generated password has no pattern to guess, so the only way in is to try every possibility. Length does most of the work: each added character multiplies the number of possibilities, which is why a 20-character password is dramatically stronger than a 10-character one even if both use the same kinds of characters.
Choosing a mode
- Password: random characters from the sets you choose. Best for anything a password manager will fill in for you. Sixteen characters with all four types is a sound default.
- Passphrase: several random words joined by a separator. Easier to remember and to type on a phone, and strong when it has enough words. Use at least six.
- PIN: random digits for phones, cards and locks. A PIN has few combinations, so it relies on the device limiting attempts. Use six digits or more where allowed.
Good password habits
- Use a different password for every account, and let a password manager remember them.
- Turn on two-step verification for email, banking and your password manager.
- Make the one password you must remember a long passphrase.
- If a site limits length or symbols, reduce the character types rather than the length.
- Change a password when a service reports a breach, not on a fixed schedule.
How the strength is calculated
The meter shows entropy in bits, calculated from the size of the character pool and the length, or from the word list size and the number of words. The crack-time line assumes an offline attack at one trillion guesses per second. It is a way to compare options, not a guarantee, and it applies to randomly generated passwords only. A password you typed yourself will usually be far weaker than its length suggests.
Frequently asked questions
Are the passwords sent or stored anywhere?
No. They are created inside your browser and never leave your device. ConverterMaster does not see, log or store them, and they disappear when you close or refresh the page.
How random are they?
Characters are chosen with your browser’s cryptographically secure random generator (crypto.getRandomValues), using rejection sampling so no character is more likely than another. It is not Math.random.
How long should my password be?
For accounts you sign in to with a password manager, 16 to 20 random characters with all types is a good default. For something you must type or remember, a passphrase of 6 or more words works better. A longer password is stronger than a more complicated short one.
What is entropy?
Entropy, measured in bits, is how many guesses an attacker needs on average: every extra bit doubles the work. Around 60 bits resists casual attacks, 80 bits or more is strong against well-funded ones, and 100 bits or more is beyond practical attack. The figure assumes the password was generated randomly, as it is here.
Is the crack-time estimate accurate?
It is a rough guide. It assumes an attacker stole the password hash and can test one trillion guesses per second, which is a fast offline attack. Real systems that rate-limit logins are much harder to attack, and weak hashing makes it easier, so treat it as a comparison between passwords rather than a promise.
Should I use a passphrase or a random password?
Use a random password for anything a password manager fills in for you. Use a passphrase for the few secrets you have to remember or type, such as your device login or the master password for your manager. Add more words if you want more strength.
How big is the passphrase word list?
It has 643 common English words, about 9.3 bits per word, and the strength shown counts only that. Six words give around 56 bits and eight words around 75 bits. Choosing more words is the way to raise it.
Why exclude look-alike characters?
Characters such as l, I, 1, O and 0 are easy to mix up when you read a password aloud or type it from paper. Excluding them makes it a little easier on people and costs only a tiny amount of strength.
Should I reuse a strong password on several sites?
No. If one site is breached, every account that shares that password is at risk. Generate a different password for each account and keep them in a password manager.
Does it work offline?
Yes. After the page has loaded, generation needs no connection.