Password Generator
Strong passwords, memorable passphrases, and the one thing other generators forget — a phonetic spelling so you can read it out loud without saying "lowercase L, no, the other one".
Press Space to generate
A password you can actually use
Most password generators hand you sixteen characters of noise and consider the job done. Then you have to type it into a television, read it to a colleague over the phone, or copy it from a sticker into a router setup page — and discover that the thing you were given contains a lowercase L, a capital I and a digit 1 sitting next to each other. The password was strong. It was also unusable.
This generator treats readability as part of the requirement rather than a nice extra. Ambiguous characters are excluded by default, so nothing you produce contains the classic confusion pairs. Every password comes with a phonetic spelling in the NATO alphabet, which turns a phone call from "lowercase L, no, the other one" into "Lima, Alfa, seven". And the strength meter reports entropy in bits along with an estimate of how long an offline attack would take, so you can see what you actually bought.
Four kinds of secret
Strong. Random characters from a mixed alphabet. The right choice for anything stored in a password manager, where you will never type it by hand. Longer is the only lever that matters — and length beats punctuation every time.
Memorable passphrase. Several unrelated words joined together. Four random words from a large list are harder to crack than a mangled single word with a dollar sign in it, and you can hold them in your head. This is the mode for the handful of passwords you must remember without help: your device login, your password manager itself.
PIN. Digits only, for door codes, SIM cards and safes. Short by nature, so the protection comes from the lockout after a few wrong attempts rather than from the length.
Spellable. Built from syllables that alternate consonant and vowel, which makes the result pronounceable and therefore dictatable. Use it when the password has to travel through a human being.
What the bits mean
Entropy in bits measures how many guesses an attacker needs, and the scale is exponential: each extra bit doubles the work. Below 50 bits a well-funded attacker with stolen password hashes gets through in a day. Around 70 bits the same attack takes years. Past 90 bits the number stops being a practical concern and the weak point moves elsewhere — to reuse, to phishing, to the service storing your password badly.
Which is worth saying plainly: length is the only dial with real leverage. Adding four characters does more for you than any arrangement of symbols, and the classic advice about mixing uppercase and punctuation mostly produced passwords that were annoying to humans and barely harder for machines.
Nothing leaves your browser
The password is generated on your device using crypto.getRandomValues(). There is no server
call when you press the button, no log, and no account. You can check that yourself: open your browser network
tab and generate — nothing is sent. That property is the whole reason to prefer a local generator over one
that produces your secret somewhere you cannot see.
Frequently asked questions
Is the password sent anywhere?
No. It is generated in your browser with crypto.getRandomValues() and never transmitted. Open your network tab and press the button — there is no request. We have no account system and no log.
How long should a password be?
Sixteen random characters for anything kept in a password manager, and four or more random words for the few you must remember unaided. Length is the only lever with real leverage; adding characters helps more than adding punctuation.
Are word passphrases really as strong as random characters?
Four unrelated words from a large list beat a mangled single word with a symbol in it, and you can actually remember them. For a passphrase the words must be chosen at random — a phrase you invented yourself is far weaker than it feels.
Why are some letters and digits missing?
Lowercase L, capital I, digit 1, capital O and digit 0 are excluded because people confuse them when reading or typing. Losing five characters costs a fraction of a bit of entropy and saves you a support call.
What is the phonetic spelling for?
Dictating a password out loud. It renders each character in the NATO alphabet, so "Lima, Alfa, seven" replaces "lowercase L, then A, then seven — no, lowercase".
How is the crack time calculated?
From the entropy of the character set and length, assuming an offline attack against stolen hashes at current consumer GPU speeds. It is an order-of-magnitude guide rather than a promise, and it says nothing about phishing or a service that stores your password in plain text.