TechCompare LogoTechCompare
Back

Password Generator

Generate secure passwords.

Configuration

16
...
Select at least one character type
Strength
Strong
Entropy
104 bits
Time to Crack
3.22e+3 billion years

Hypothetical fast offline-guess baseline at 100 billion attempts/sec. Actual crack time depends heavily on the storage algorithm, work factor, hardware, and rate limits.

How to use this tool

  1. Set the password length

    Choose a length of 16 characters or more for a password that resists brute-force attacks on modern hardware. Longer is always stronger, with diminishing returns past 20 characters.

  2. Select character classes

    Toggle uppercase letters, lowercase letters, numbers, and symbols. Including all four classes maximizes entropy. The generator draws every character from the browser's crypto.getRandomValues() CSPRNG.

  3. Generate the password

    Click generate to produce a fresh cryptographically random password. The generated password stays in your browser and is not uploaded or stored by this tool. The page may still make normal requests for site assets and analytics.

  4. Copy and store in a password manager

    Copy the password to your clipboard and paste it into a password manager like Bitwarden, 1Password, or Apple Passwords. Never reuse a password across accounts, and enable 2FA wherever possible.

About this tool

The Password Generator produces cryptographically random passwords of any length, with customizable character classes including uppercase, lowercase, numbers, and symbols. It runs entirely in your browser. Every character is drawn from the browser's native crypto.getRandomValues() API, which is the same CSPRNG source used by TLS handshakes and Web Crypto key generation. That means the outputs are suitable for real secrets, not just demo data.

Use it to create master passwords for a password manager, one-off tokens for development, seed values for environment variables, or fresh recovery codes. Generated passwords stay local unless you copy them, so they're safe to create before storing in your password manager.

How it works

Random bytes are pulled from crypto.getRandomValues() and mapped to a character set you select. Longer passwords with more character classes have exponentially more possible values, measured in bits of entropy: 16 characters from a 90-character alphabet gives about 104 bits of entropy, well beyond brute-force reach for today's hardware.

When to use it

Any time you need a new credential: a new account, an API key for a script, a recovery password, or a one-off token for a test environment. Pair with the Encoding Converter if you need the password Base64-encoded for an environment file, and the JSON Formatter when embedding credentials into a structured config.

Popular password guides

Practical security guidance on length, entropy, passphrases, and password managers.

Password length guide
Why 16+ characters beats complexity in 2026
View details ➜
Passphrase vs password
correct-horse-battery-staple and the entropy math
View details ➜
Password manager guide
Bitwarden, 1Password, Apple Passwords compared
View details ➜

Frequently asked questions

How long should a secure password be?
16 characters or more, drawn from uppercase, lowercase, numbers, and symbols. A 16-character mixed password is currently impractical to brute-force with commodity hardware, while 8-character ones can be cracked in hours by modern GPUs.
Is the generated password actually random?
Yes. The generator uses the browser's crypto.getRandomValues(), a cryptographically secure random source backed by OS entropy. The output is suitable for production password managers and API keys, but it does not generate wallet seed phrases or BIP-39 mnemonics.
Is my password saved anywhere?
No. Password generation runs in your browser with crypto.getRandomValues(), and the generated password is not sent to TechCompare or stored by this tool. The page may still load normal site assets and analytics requests.
What's the difference between a passphrase and a password?
A passphrase is a string of dictionary words (like "correct-horse-battery-staple"), long but memorable. A password is usually shorter with mixed character classes (like "Kx9$mQ2!pR"). This tool generates cryptographically random character passwords, not dictionary-word passphrases.
Should I use the same password everywhere?
Never. Use a password manager (Bitwarden, 1Password, Apple Passwords) and generate a unique strong password for every site. Password reuse is the single biggest cause of account takeover. One breached service leaks the credential, and every other account using it is automatically compromised.
How often should I change my passwords?
Modern guidance (NIST SP 800-63B) says don't rotate strong unique passwords on a schedule. Only change them if you suspect compromise. Forced rotation encourages weak, incremented passwords. Strong password + password manager + 2FA is safer than any rotation policy.

Related tools

Text Encoding Converter

Convert between Text, Base64, Binary, Hexadecimal, and Decimal formats.

Use tool ➜

Unix Timestamp

Convert between Unix timestamps and human-readable dates.

Use tool ➜

JSON Formatter

Validate, format, and minify JSON data with readable output and error detection.

Use tool ➜

Contrast Checker

Check color contrast ratios for WCAG AA/AAA accessibility compliance.

Use tool ➜