Skip to content
StoutNook
Menu
Every tool runs in your browser. Your files never leave your device.

Password generator

Make a strong, random password of any length, or a passphrase of random words that's easier to type and remember. Passwords are created on your device with your browser's secure random generator and never sent anywhere.

What do you want?
Use

Handy if you'll ever read or type it from paper. It makes the password slightly weaker, so add a character or two.

Your password
Generating…
Very strong129 bits of entropy

Guessing it would take about longer than the age of the universe on average for an attacker making 100 billion guesses a second, even knowing exactly how it was made.

The link keeps your settings, never the password.
  • Generated on your device, never sent
  • Free, no sign-up
  • Works on phone and desktop

How to create a strong password

  1. 1

    Choose Random password, or Passphrase if you need to type or remember it.

  2. 2

    Set the length: 16 characters or more is a good default. Switch off any character types a site doesn't accept.

  3. 3

    Click Copy and paste it into the site, then save it in your password manager.

  4. 4

    Not keen on this one? Click New password or pick one from the list underneath.

Features

  • Truly random

    Made with your browser's cryptographic random generator, with no bias toward any character.

  • Passwords or passphrases

    Random characters for a password manager, or random words when you have to type it.

  • Honest strength meter

    Strength is measured in bits for exactly how the password was made, not guessed from its look.

  • Never leaves your device

    Nothing is sent or stored. Share link keeps your settings only, never the password.

What makes a password strong

Attackers don't guess passwords one by one at a login screen. They take lists of passwords stolen from breaches and test billions of guesses a second against them, starting with words, names, dates, keyboard patterns and every common trick such as swapping "a" for "@". A password resists that only if it is random and long. Random means not chosen by a person; long means every extra character multiplies the work.

Random password lengthEntropyAverage time to guess*
8 characters52 bits4 hours
12 characters77 bits297 centuries
16 characters103 bitslonger than the age of the universe
20 characters129 bitslonger than the age of the universe
24 characters155 bitslonger than the age of the universe

*Letters, numbers and symbols, against an attacker making 100 billion guesses a second, which is a fast offline attack on a poorly protected password database. Well-run sites store passwords with slow hashing, which makes every guess far more expensive.

Good habits that matter more than any generator

  • One password per site. When one site is breached, reused passwords let attackers into your other accounts.
  • Use a password manager to store them, and protect it with a strong passphrase.
  • Turn on two-step verification (an authenticator app or a passkey) for email, banking and anything important.
  • Don't change passwords on a schedule for no reason; change them when a site is breached. NIST's digital identity guidelines (SP 800-63B) favor long passwords over complexity rules and advise against forced periodic changes.

Already have a password you want to test? The password strength checker looks for the patterns attackers try first, and the password leak check tells you whether it has appeared in a known data breach, without sending it.

Frequently asked questions

Is it safe to generate a password online?

It is here, because the password is made by your browser on your own device and never sent anywhere. You can even load the page, switch off your internet connection and generate one. Avoid sites that create passwords on their server.

How long should a password be?

For a password you store in a password manager, 16 to 20 random characters is plenty. If you must type or remember it, a passphrase of 6 random words is both strong and practical. Length adds far more strength than swapping letters for symbols.

Is a passphrase better than a password?

Both are strong when they're random. A 6-word passphrase from a 7,776-word list has about 77 bits of entropy, similar to a 12-character random password, and it's much easier to type on a phone or TV. The words must be chosen at random, not by you.

Do I need symbols in my password?

Not for strength if the password is long and random, but many sites still demand one. Leaving symbols out costs a little strength, which a couple of extra characters makes up for.

How do I remember all these passwords?

Use a password manager: it remembers a different strong password for every site, so you only need one strong passphrase for the manager itself. Turn on two-step verification wherever you can.

What does "bits of entropy" mean?

It measures how many guesses a password could take. Each extra bit doubles the number of possibilities, so 80 bits is a million times harder to guess than 60. It applies to random passwords; passwords people make up are much weaker than their length suggests.

More free tools