Tech BicharStrong Password Generator
Create random, uncrackable passwords, memorable passphrases and PINs right in your browser. Free, ad-free and private — nothing you generate ever leaves your device.
Generator
Advanced options
Words come from the 1,296-word EFF short list: short, common and easy to type.
A PIN is only as safe as the lockout policy protecting it. Use 6+ digits and avoid dates, repeats and sequences — this generator never produces those patterns on purpose, it is simply random.
Recently generated (this session only, never saved)
Shortcuts: Space or Enter new password · C copy · 1/2/3 switch mode
- 100% in your browserGenerated with the Web Crypto API on your device. No server, no database, no logs.
- No ads, no tracking scriptsA distraction-free page: no banners, pop-ups or push prompts. Nothing to click through.
- Works offlineEverything is embedded in this page. Save it and use it without an internet connection.
How this password generator works
Every character is chosen with crypto.getRandomValues(), the cryptographically secure random number generator built into modern browsers and seeded by your operating system. The tool never uses Math.random(), and it uses rejection sampling so every character in your chosen pool is exactly as likely as any other — there is no modulo bias that would make some characters more common.
You decide the recipe: length, which character groups to include, the exact symbols allowed, whether look-alike characters should be dropped and whether every selected group must appear at least once. The result is shuffled and shown with numbers and symbols colour-coded so you can read it back reliably. In passphrase mode the tool picks words from the EFF short word list, a curated list of 1,296 common, unambiguous English words designed for exactly this purpose.
What makes a password strong?
Strength is measured in bits of entropy: how many equally likely possibilities an attacker has to try. For a random password it is simply
entropy = length × log2(size of character pool)
A 12-character password using letters, numbers and symbols (a 90-character pool) has about 78 bits. Adding four more characters lifts it to 104 bits, which is 226 — about 67 million — times harder to crack. That is why length beats complexity: every extra character multiplies the work for an attacker, while swapping an "a" for an "@" barely matters and is the first thing cracking software tries.
Randomness matters just as much as length. Human-made passwords such as Summer2024! or P@ssw0rd follow patterns that cracking dictionaries model directly, so they fall in seconds no matter how many symbols they contain. A generator removes that weakness: nothing in the output is predictable.
How long does it take to crack a password?
The table shows the average time an attacker needs to find a random password, for two realistic scenarios: an offline attack against a fast hash such as MD5 or NTLM with a GPU rig doing 100 billion guesses per second, and an offline attack against a slow, properly configured hash such as bcrypt or Argon2 at 10,000 guesses per second.
| Password | Entropy | Fast hash (1011/s) | Slow hash (104/s) |
|---|---|---|---|
| 8 lowercase letters | 37.6 bits | 1 second | 4 months |
| 8 characters, all types | 51.9 bits | 6 hours | 7 thousand years |
| 12 characters, all types | 77.9 bits | 45 thousand years | 447 billion years |
| 16 characters, all types | 103.9 bits | 3 trillion years | more than a quintillion years |
| 20 characters, all types | 129.8 bits | more than a quintillion years | more than a quintillion years |
| 5-word passphrase | 51.7 bits | 5 hours | 6 thousand years |
| 6-word passphrase | 62.0 bits | 9 months | 8 million years |
| 8-word passphrase | 82.7 bits | 1 million years | 13 trillion years |
"All types" means uppercase, lowercase, numbers and the default 28 symbols (90 characters). Passphrase figures use the 1,296-word EFF list. Online attacks against a live login page are far slower, usually under 1,000 guesses per second, and are further limited by lockouts.
Password or passphrase — which should you use?
Random passwords pack the most strength into the fewest characters, which makes them ideal for anything a password manager fills in for you: websites, apps, API keys and database credentials. Aim for 16–24 characters, or the maximum the service allows.
Passphrases trade a little length for a lot of memorability. "Ozone-Mango-Quilt-Harbor-Velvet-Cinema" is 38 characters long yet far easier to remember and type than a 12-character random string of similar strength. Use passphrases for the handful of secrets you must know by heart: your password-manager master password, your computer login, disk-encryption keys and your Wi-Fi network.
PINs are for devices and cards that enforce a lockout after a few failed attempts. Random 6-digit PINs avoid the birthdays, repeats and sequences that make up most real-world PINs.
Password security best practices
- Use a unique password for every account. Reuse turns one breach into many. Credential-stuffing attacks try leaked email and password pairs on hundreds of other sites automatically.
- Let a password manager remember them. Bitwarden, 1Password, KeePassXC or the manager built into your browser or phone can store thousands of random passwords behind one strong passphrase.
- Go long: 16 characters or more. Length is the single biggest factor in strength. If a site limits length, use every character it allows and all character types.
- Turn on two-factor authentication (2FA). An authenticator app or hardware key stops attackers even if your password leaks. Prefer app or key based codes over SMS where possible.
- Prefer passkeys when offered. Passkeys replace passwords with device-bound cryptographic keys and cannot be phished or reused.
- Never share passwords over chat or email. Use your password manager's sharing feature or a one-time secret link instead, and change the password afterwards.
- Change passwords after a breach, not on a schedule. Forced rotation leads to weaker, patterned passwords. Instead, check a service such as Have I Been Pwned and replace any password that has been exposed.
- Avoid personal information and dictionary tricks. Names, birthdays, pet names, keyboard walks like qwerty and substitutions like P@ssw0rd are all in cracking dictionaries.
- Protect your email account most of all. It resets every other password you own. Give it your strongest passphrase and 2FA.
Your privacy on this page
This tool was built to be trustworthy by design. The generator is plain JavaScript that runs on your computer or phone; there is no backend, no form submission and no analytics event tied to what you generate. We do not use cookies here, and the only thing saved locally is your light/dark theme choice. If you would like to verify this, open your browser's developer tools and watch the network tab while you generate passwords: nothing is sent.
Frequently asked questions
Is this password generator safe to use?
Yes. Passwords are generated on your device with the Web Crypto API (crypto.getRandomValues), the same cryptographically secure random source used by password managers. The page makes no network request after it loads, sets no cookies and stores nothing except your light/dark theme preference.
Are the generated passwords stored or sent anywhere?
No. Nothing you generate leaves your browser. There is no server-side code involved in generation, no database and no logging. The "recently generated" list lives only in the page memory and disappears when you close or reload the tab.
How long should my password be?
Use at least 16 characters with letters, numbers and symbols for important accounts (email, banking, cloud storage), which gives roughly 104 bits of entropy. For accounts protected by a password manager you can go longer — 20 to 32 characters — because you never have to type them. If you must remember a password, a 6-word passphrase is easier to memorise and just as strong as a 10-character random password.
What is a passphrase and is it better than a password?
A passphrase is a sequence of random words such as "acorn-lunar-plaza-tidy-grape-cabin". Each word from the 1,296-word EFF list adds about 10.3 bits of entropy, so six words give 62 bits and eight words give 83 bits. Passphrases are easier to type and remember than random character strings, which makes them ideal for master passwords, Wi-Fi keys and device logins.
How is password strength calculated?
The meter shows entropy in bits: the number of characters multiplied by log2 of the size of the character pool you selected (for example 16 characters from a 90-character pool is about 104 bits). The crack-time estimate assumes an offline attacker guessing 100 billion passwords per second and shows the average time needed to find the password. It measures randomness, not how "clever" the password looks — a random 16-character password is always stronger than a memorable phrase you invent yourself.
Can I exclude look-alike characters such as 0, O, l, 1 and I?
Yes. Enable "Exclude look-alike characters" under Advanced options to remove 0, O, o, 1, l, I and | from the pool. This is useful for passwords that will be read aloud, printed or typed on a phone. You can also remove or add any symbols by editing the symbol list, or exclude specific characters a website does not accept.
Does the password generator work offline?
Yes. All code and the word list are embedded in this page. Once it has loaded you can disconnect from the internet, or save the page (Ctrl+S) and open it later, and it will keep working exactly the same way.
Should I reuse a generated password on several websites?
No. Reused passwords are the main way accounts get hijacked: when one site is breached, attackers try the same email and password everywhere else (credential stuffing). Generate a unique password for every account and keep them in a password manager so you only have to remember one strong master passphrase.
How random are the passwords? Do you use Math.random()?
Passwords never use Math.random(), which is predictable and not designed for security. The generator uses crypto.getRandomValues() with rejection sampling to pick each character, so every character in the pool is equally likely and there is no modulo bias.
Can I generate several passwords at once?
Yes. Set the quantity to any number from 1 to 25 and the tool lists them all with individual copy buttons, a "Copy all" button and a download option that saves them as a plain text file.