Password Generator & Strength Checker — Free, 100% Local

Generate secure random passwords or memorable passphrases, then check any password’s real crack time and pattern weaknesses. Nothing you type ever leaves your browser. Most password generators stop at “here’s a random string.” This one does both halves of the job: it generates strong passwords or passphrases using your browser’s built-in cryptographic random number generator, and it checks how strong a password actually is — not with a rough character-count guess, but with a realistic estimate of how long it would actually take someone to crack it. Everything runs locally in your browser tab. Nothing you generate or type is ever sent to a server, logged, or saved anywhere outside this page.

What this tool does

Generate mode builds passwords two ways. Character mode gives you full control over length and which character types are included — lowercase, uppercase, numbers, symbols — with an option to exclude visually ambiguous characters like 1, l, I, 0, and O, plus a field to exclude any other specific characters a picky login form won’t accept. Passphrase mode strings together several random dictionary words instead, which trades a little raw entropy for something a human can actually read back and remember, with optional capitalization and a random digit thrown in. Either type can be generated one at a time or in bulk — useful when you’re rolling out new logins for a whole team at once.

Check mode flips the tool around. Paste in a password — one you’re already using, or one a form is asking you to create — and it’s scored using pattern-aware analysis, the same category of approach used by real-world breach-prevention tools. Rather than only assuming a password is fully random (which most simple strength meters do, and which overstates how safe a predictable password actually is), it looks for dictionary words, keyboard patterns like qwerty or asdf, repeated characters, common substitutions like @ for a, and sequences like 1234, then estimates realistic crack times across four attack scenarios: a rate-limited online login form, an online form with no rate limiting, an offline attacker using a slow hash like bcrypt, and an offline attacker using a fast hash with GPU cracking. Two very different-looking passwords can have wildly different real-world crack times even at the same length, and this is why.

How it works

Password generation uses crypto.getRandomValues() — the Web Crypto API’s cryptographically secure random number source, the same one browsers use to generate encryption keys and session tokens. That’s a meaningfully different (and stronger) source than Math.random(), which most quick-and-dirty password generators quietly rely on and which was never designed to be unpredictable. Every generated password also guarantees at least one character from each type you’ve selected, so a short password with all four types checked won’t accidentally roll one missing a whole category.

Passphrase mode draws from a curated list of common, easy-to-type English words rather than obscure or hard-to-spell ones, so what you get back is something you can actually read aloud or type on a phone keyboard without hunting for characters.

Check mode’s pattern analysis loads a small strength-analysis library the moment you switch to it — not before, so it never slows down the Generate side of the tool for people who only need a quick random password. Whatever you type into the check field stays in your browser’s memory for as long as the tab is open and disappears the moment you navigate away; it’s never written to storage, sent over the network, or logged anywhere.

How to use it

Choose Generate or Check strength at the top of the tool.
In Generate mode, pick Characters or Passphrase, then adjust the length (or word count), character types, and any exclusions in the panel on the right.
Choose Single for one password, or Bulk to generate several at once — handy for setting up multiple accounts or a team rollout.
Click Generate, then use the copy icon to copy it to your clipboard. There’s an optional setting to automatically clear your clipboard 20 seconds after copying, useful on a shared or public machine.
To check the strength of what you just generated — or any existing password — switch to Check strength, paste it in, and review the crack-time table and any suggestions.

Common situations this solves

Creating a new account and the site demands “at least one symbol, one number, and 12 characters” — set the character types once, and every password after that already meets the requirement.
Migrating a team off shared or reused logins — bulk-generate a full batch of unique passwords in one pass instead of creating them one at a time.
Replacing an old password you’re not sure is still safe — paste it into Check mode before you assume it still holds up; a password that looked fine in 2018 can look very different against modern GPU cracking speeds.
Needing something you can actually remember — switch to Passphrase mode instead of fighting to memorize a random character string.
Auditing a password before submitting it to a client’s security policy or an employer’s IT team — the crack-time table gives you something concrete to point to, rather than just a vague “strong” label.

Frequently asked questions

Is it actually safe to generate a password on a website?

This tool generates everything locally, inside your browser, using the same secure random number source your browser already uses for encryption keys. Nothing is transmitted anywhere or stored on a server — closing the tab is the same as it never having existed.

What’s the difference between a password and a passphrase?

A password is a string of random characters (zYzIt?$8-.W0<~S); a passphrase is a string of random dictionary words (meadow-triumph-otter-4). At equivalent length, a character password usually has more entropy, but a passphrase is far easier for a human to remember and type correctly, which matters when the alternative is writing it down somewhere less secure.

How is “crack time” actually calculated?

Rather than assuming your password is fully random (which overstates its real strength if it contains a dictionary word or common pattern), the check looks at the password’s actual structure — words, substitutions, sequences, repeats — the same way an automated password-guessing tool would, then estimates how many guesses that approach would realistically take across different attack speeds.

Why does the same password show different bit counts in “theoretical max” versus “realistic estimate”?

The theoretical number assumes every character was chosen completely at random from the available character set. The realistic number accounts for the fact that most “random-looking” passwords humans create actually follow patterns — and patterns are exactly what real attackers search for first. A password with real dictionary words in it will always show a lower realistic estimate than its raw length would suggest.

Can I generate more than one password at a time?

Yes — switch to Bulk mode and set how many you need (up to 50 at once), then copy them all or download the batch as a text file.

Should I exclude ambiguous characters like 0, O, 1, and l?

Only if you’ll ever need to type the password by hand rather than paste it — from a physical sticky note, or reading it aloud to someone. If you’re always copying and pasting, there’s no downside to leaving them in, and it slightly increases the character pool.

Also check out:

Hash generator– for one-way hashing text or files
Token Generator for random API keys and session tokens
UUID generator for unique identifiers — all built the same way, running entirely in your browser with nothing ever uploaded.