ToolNexIn
Home Security Tools Password Generator

Password Generator - 6 Modes, Strength Meter & Crack Time Estimate

Generate cryptographically strong passwords in 6 modes - random, passphrase, pronounceable, PIN, pattern, and API secret keys. Instant strength score with real entropy bits, crack-time against brute-force and GPU attacks, bulk export, site-specific presets. Everything runs in your browser. Nothing is ever sent to our servers.

Always Free crypto.getRandomValues() 6 generation modes Works offline
Random · Passphrase · Pronounceable · PIN · Pattern · API Key
Cryptographically secure - uses browser's crypto.getRandomValues(), not Math.random()
Zero server contact - passwords are never transmitted, logged, or stored anywhere
Crack time estimate against offline brute-force, dictionary, and GPU attacks
Use a different password for every account. If one site is breached, attackers try the same password on banking, email, and social sites - this is called credential stuffing.
Generation mode
Site presets — auto-configures requirements
Press Space to regenerate
Click generate to create your password
— 0 bits
💻
Online attack
—
1K guesses/sec
🖥️
Offline brute-force
—
1B guesses/sec
⚡
GPU cluster
—
100B guesses/sec
Bulk generator — same settings, multiple passwords
Click "Generate all" to create multiple passwords at once
Session history — last 20 passwords generated
No passwords generated yet this session

History is stored only in this browser tab and is erased when you close it. Nothing is sent to our servers.

What's different

Most generators give you a random string.
This one explains why it's strong or weak.

Real entropy bits, crack-time against actual attack models, 6 generation modes, bulk export, site presets - not just a character checkbox and a copy button.

Real entropy calculation

See the actual information-theoretic entropy of your password in bits, not just a vague "weak/strong" label. Understand exactly what makes your password more or less guessable.

understand your security

3-scenario crack time

Crack time is shown against three real attack scenarios: online throttled attacks (1K/s), offline brute-force (1B/s), and GPU cluster attacks (100B/s). Actual numbers, not guesses.

three attack models

6 generation modes

Random for maximum entropy, Passphrase for memorability, Pronounceable for accounts without a manager, PIN for devices, Pattern for company format requirements, and API keys for developers.

right type for the use case

Site-specific presets

Banking, email, social, gaming, Wi-Fi, enterprise, master password, and crypto presets auto-configure the generator to meet the actual requirements and best practices for each context.

no manual settings needed

Bulk generator

Generate up to 50 passwords at once using your current settings. Copy all to clipboard or download as a .txt file. Perfect for seeding user accounts, testing, or handing out temporary credentials.

50 passwords in one click

crypto.getRandomValues()

We use the browser's cryptographic random number generator - the same one used by password managers and security software - never the predictable Math.random(). Nothing is sent to our servers.

actually cryptographically secure

Quick guide

Create a strong password in 3 steps

1

Choose a mode and preset

Select a generation mode (Random for stored passwords, Passphrase if you need to memorise it), then optionally click a site preset to auto-configure length and character requirements.

2

Check the strength score

Look at the entropy bits and crack-time cards. Aim for at least 60 bits of entropy. If the GPU crack time is under 1 million years, increase the length or add more character types.

3

Copy and save in a manager

Copy the password, then immediately save it in a password manager (Bitwarden is free). Never store passwords in notes, spreadsheets, or browser autofill on shared devices.

Why password length matters more than complexity

The conventional wisdom that special characters make passwords secure is partially true - but length is the dominant factor. A 20-character password using only lowercase letters has more possible combinations than a 12-character password using every character type. Each additional character multiplies the keyspace exponentially.

0-28 bits
Trivial
29-35
Weak
36-59
Moderate
60-79
Strong
80-99
Very strong
100+
Extreme

When to use each generation mode

ModeBest forTypical entropyMemorable?
RandomAny stored password in a manager80-130 bitsNo - store it
PassphraseMaster passwords, accounts you must type51-90 bitsYes - 4+ words
PronounceableAccounts without a manager, shared verbally40-70 bitsYes - sayable
PINDevice unlock codes, ATM PINs, numeric-only fields13-20 bitsYes - short
PatternCompany IT policies with specific format rulesVariesDepends
API / SecretDeveloper tokens, webhook secrets, JWT signing keys128-256 bitsNo - paste it
The passphrase debate. NIST's 2024 password guidelines (SP 800-63B) no longer recommend mandatory special character requirements. Instead, they recommend length and checking against known-breached password lists. A 5-word diceware passphrase now meets NIST guidance for most high-assurance accounts - and is far easier to remember than P@ssw0rd123!.

What attackers actually do

Real password attacks don't try every combination starting with "aaaa". Attackers use credential stuffing (reusing leaked passwords), dictionary attacks (known words and common substitutions), and rule-based attacks (systematic mutations like adding numbers at the end). The patterns people think make passwords clever - like replacing E with 3, or adding 123 - are the first things attackers try.

The three crack-time estimates in this tool model three different attack scenarios: throttled online attacks (where a login form blocks after 10 tries), offline attacks where the hash has been leaked and an attacker can try billions per second on a single machine, and GPU cluster attacks representing nation-state or well-resourced criminal capabilities at 100 billion guesses per second.

Should I use a password manager?

Yes, without qualification. Bitwarden is free and open-source. 1Password and NordPass are premium options. The practical security benefit of using unique passwords everywhere, enabled only by a manager, far outweighs any theoretical risk of keeping passwords in a vault. 81% of data breaches involve reused or weak passwords - using a manager addresses that directly.

Pairs well with

Related free tools

Password Strength Checker

Test any password against real attack vectors

Hash Generator

Generate MD5, SHA-1, SHA-256 and more

UUID Generator

Generate cryptographically random UUIDs v4

Base64 Encoder

Encode and decode Base64 strings instantly

FAQ

Password questions,
answered honestly.

Ask a question
Security experts recommend at least 14-16 characters for important accounts. Length is the single most powerful factor - each extra character multiplies the possible combinations exponentially. A 20-character password is vastly harder to crack than a 12-character one, even without special characters.
Yes. All generation happens in your browser using crypto.getRandomValues() - the same cryptographic API used by password managers and security software. No passwords are sent to our servers, logged, or stored. You can disconnect from the internet and the tool still works.
A passphrase is a sequence of random words (e.g. correct-horse-battery-staple). A 4-word passphrase from a large wordlist gives about 51 bits of entropy - roughly equivalent to a 10-character random password. With 5-6 words it becomes very strong while remaining memorable. NIST recommends passphrases for accounts you must memorise.
Entropy measures unpredictability in bits. Each bit doubles the possible combinations. 60 bits = 2^60 combinations. Above 80 bits is considered very strong; 128+ bits is effectively unbreakable with any realistic technology today. The meter shows raw entropy based on character set size and length.
Absolutely yes. A password manager is the only practical way to use a unique, strong password for every account. Without one, people inevitably reuse passwords. Reuse is the single biggest cause of account takeovers. Bitwarden is free and open-source. 1Password and NordPass are excellent paid options.
Pronounceable mode builds passwords from consonant-vowel syllable patterns, making them sayable aloud (e.g. Baletimof42!). Use it when you need to memorise a password without a manager, or when you need to share a password verbally with someone. It is less secure than a fully random password of the same length, so compensate with extra length.