Password Tool

Choose country, region and language

Switching language will not change or regenerate your current passwords.

Americas

Europe, Middle East & Africa

Asia & Pacific

Regional & Worldwide

60 country, region and worldwide versions · Search local and English names RTL: עברית / العربية · passwords remain LTR

Random Password Generator

Generate 10 secure passwords at once. Click to select and copy.

Generated locally · never uploaded or saved

Generated passwords

Default 10 characters · 10 passwords · uppercase + lowercase + numbers

Transparent local analysis

Randomness and character distribution

This chart summarizes the current generated batch without exposing its password text. A small sample cannot prove random-number quality.

Randomness and character distribution
Sample size0
Theoretical entropy ceiling—
Uppercase0
Lowercase0
Numbers0
Symbols0
Repeated passphrase words0

The ceiling assumes the selected generator model is uniform. It is not a guarantee for a reused, human-chosen, or exposed password.

Local security workspace

Session-only generation history and export

This panel keeps only batch metadata in session storage. Password text stays in memory and is exported only if you explicitly choose it.

Warning: exported files may contain sensitive passwords. Save them only in a trusted location.

Recent local batches

Recent local batches
TimeModeCountLengthEntropy

Generate a password batch to see local metadata here.

Local security check

Password crack time estimator

See how common words, patterns, and length affect an estimated attack time.

Evaluated only in this browser. Never uploaded, logged, or saved.

Estimated time · offline fast hash (10 billion guesses/second)

Enter a password to estimate

Compare four attack scenarios
Online, rate limited (100/hour)
—
Online, no rate limit (10/second)
—
Offline, slow hash (10,000/second)
—
Offline, fast hash (10 billion/second)
—

Estimate only—not a guarantee. Actual time depends on password storage, hashing cost, attacker hardware, and whether the password is reused or exposed.

A private generator with a clear boundary

This free random password generator creates strong, secure passwords on your device using the browser’s Web Crypto API. It does not require an account, does not generate passwords on a server, does not upload generated passwords, and does not include generated passwords in analytics or advertising events.

PwdGen works in modern browsers including Chrome, Edge, Safari, Firefox, and current mobile browsers that expose Web Crypto. If Web Crypto is unavailable, the generator fails closed instead of silently falling back to insecure randomness.

Trust at a glance

How to use it safely

  1. Choose a length accepted by the service. For a password used as the only login factor, prefer at least 15 or 16 characters.
  2. Keep uppercase letters, lowercase letters, and numbers enabled. Add symbols when the destination service accepts them.
  3. Generate a different password for every account.
  4. Save the result in a trusted password manager instead of reusing or memorizing a predictable pattern.
  5. Enable MFA or a passkey whenever the service offers it.

For a deeper walkthrough, read how to create a strong password, compare how long a password should be, and learn how password managers, MFA, and passkeys work together.

You can also browse the password tools hub, the password security guides, or the browser support page.

Why the default score is medium

The tool keeps the existing 10-character default for compatibility, but it does not label that default “strong.” Length is one of the most important controls against password guessing. A 15–19 character result is labeled strong, while 20 or more characters can be labeled very strong when the selected character pool is sufficiently broad.

Random password generator options

Choose a length from 6 to 64 characters and generate 5, 10, or 20 passwords at once. You can include uppercase letters, lowercase letters, numbers, and symbols, or exclude similar characters such as 0, O, 1, I, and l. Every result includes at least one character from each enabled character source.

What local generation does not protect against

Local generation cannot stop phishing, malicious browser extensions, device malware, keyloggers, unsafe clipboard managers, or someone watching a shared screen. After copying, the password may remain in the operating system clipboard until another value replaces it. Treat the generated value as a secret as soon as it appears.

Verify the claim yourself

Open your browser developer tools, select the Network panel, clear the request list, and then regenerate, change settings, and copy a password. Those actions should not produce Fetch, XHR, or Beacon requests containing the password. The implementation uses crypto.getRandomValues() and rejection sampling instead of Math.random() or biased modulo selection.

Sources