Free Password Generator & Strength Checker

Weak passwords are still the number one cause of account breaches. People know they should use strong passwords, but generating one that’s actually secure — and not just “Password123!” — takes more thought than most people have time for.

That’s why I built a free password generator that runs entirely in your browser. No server requests, no logging, no accounts. It generates random passwords and passphrases, shows you exactly how strong they are, estimates how long they’d take to crack, and even gives you a QR code to transfer them to your phone.

What the Tool Does

The generator has two modes: Password and Passphrase.

Password Mode

You set the length (8 to 64 characters) and toggle which character types to include: uppercase letters, lowercase letters, numbers, and symbols. The tool generates a cryptographically random password using the Web Crypto API built into your browser. This is the same randomness source that banks and encryption software rely on.

As you adjust the settings, the strength meter updates in real time showing entropy in bits. Entropy measures randomness — the higher the number, the harder the password is to crack. Under 36 bits is weak, 60 to 80 is strong, and anything above 100 bits is practically unbreakable with current technology.

Passphrase Mode

Passphrases like “wolf-thunder-castle-42” are both secure and easy to remember. You pick how many words (3 to 8), choose a separator (dash, dot, underscore, or space), and optionally add a number or capitalize words. The words are randomly selected from a wordlist using cryptographic randomness, not human choice. That distinction matters because humans are terrible at being random.

A 4-word passphrase with a random number has enough entropy to resist brute-force attacks while being something you can actually type from memory.

Crack Time Estimates

This is the most useful part. After generating a password, the tool shows you four crack time scenarios:

Online throttled (100 guesses/sec) simulates an attacker hitting a login page with rate limiting enabled. Most modern apps enforce this. Online fast (1,000 guesses/sec) simulates a login page without rate limiting. Offline bcrypt/Argon2 (50,000 guesses/sec) simulates an attacker who stole a database that uses proper password hashing. Offline MD5/SHA1 (100 billion guesses/sec) simulates an attacker with a modern 8x RTX 4090 GPU cluster cracking weak hashes.

The difference between those last two is staggering. A 12-character password that would take centuries to crack against bcrypt might fall in minutes against MD5. This is why how your app stores passwords matters just as much as the password itself.

QR Code Transfer

After generating a password, a QR code appears that you can scan with your phone. This is handy when you’re setting up an account on your computer but need the password on your phone, or when you want to transfer it to a password manager on another device without typing 20+ random characters.

Password History

The tool keeps your last 5 generated passwords in a local list (stored only in your browser, never on a server) so you can go back if you accidentally generated a new one before copying the previous one. You can clear the history anytime.

Privacy and Security

Everything runs client-side in your browser. The passwords are generated using crypto.getRandomValues(), which is a cryptographically secure random number generator. No passwords are sent to any server, stored in any database, or logged anywhere. The tool works fully offline after the page loads. You can verify this yourself by opening your browser’s network tab — zero outbound requests after the initial page load.

Security Tips Built In

The tool includes five security tips below the generator:

1. Use at least 16 characters for important accounts
2. Never reuse passwords across different services
3. Use a password manager like Bitwarden or 1Password
4. Enable two-factor authentication whenever available
5. Passphrases are easy to remember and extremely secure

When to Use This

Use it when you’re creating a new account and need a strong password. Use it when you’re resetting a password that was too weak. Use it when you’re setting up a database, API key, or server credential. Use it when you want to show a client or team member what a properly strong password looks like.

If you’re building PHP applications that store user passwords, you also need to understand how to hash them properly on the server side. Check out How PHP Password Hashing Works for the complete guide on bcrypt, password_hash(), and why MD5 will get your users hacked.

Try the Password Generator →

Also check out the other free tools on my site: Business Card Generator, Invoice Generator, QR Generator, Password Hasher, Tech Stack Detector, and Excel Formula Finder.